What is DLT URL whitelisting?
DLT URL whitelisting is the requirement, set by TRAI under the TCCCPR framework, that every URL, APK link or OTT link in a commercial SMS sent in India is registered in advance on the sender's DLT account. TRAI directed access providers on 20 August 2024 to block traffic carrying links that are not whitelisted, and the rule has been enforced since 1 October 2024: a message with an unregistered link fails DLT Scrubbing and never reaches the handset.
Whitelisting sits beside template approval, not inside it. A DLT Content Template registers the wording of a message and its {#var#} placeholders; the whitelist registers the links that may appear in it, at whatever level the operator's portal accepts (a domain or a specific URL). A link inserted through a variable is still checked, so an approved template does not protect a link nobody whitelisted. TRAI's direction also named call-back numbers on a separate, later timeline, so check your operator's DLT portal for their current status.
The rule exists because links are how most SMS fraud works: phishing pages, fake payment links and malicious APK downloads. Tying every link to a registered principal entity makes each one traceable. For senders it turns link hygiene into a release step: new landing domains, short-link services, app-store links and campaign tracking URLs all have to be on the list before the first send, alongside the header and template from DLT Registration.
Key takeaways
- DLT URL whitelisting means every URL, APK or OTT link in an Indian commercial SMS must be registered on the sender's DLT account first.
- Since 1 October 2024, operators block SMS containing links that are not whitelisted, even when the template itself is approved.
- Public URL shorteners are a common cause of failures; whitelist a branded short domain you control instead.
- Whitelisting checks links and template approval checks wording: a message needs to pass both.
Figure 1
Is every link in your SMS ready to pass?
7/7
ticked
- Required
- 5 / 5
- Optional
- 2 / 2
Links ready to pass scrubbing
Every item ticked.
Links ready to pass scrubbing. 7 of 7 ticked.
Why it matters
Why does DLT URL whitelisting matter?
Marketing and product teams change links far more often than wording: a new landing page, a different short-link service, a deep link into the app. Under URL whitelisting each of those changes can silently zero out an SMS campaign, an OTP flow or a payment reminder in India. Making link registration part of the release checklist, and checking outgoing text against the whitelist in code, keeps a link change from becoming an outage. Campaign Analytics depend on it too: tracking parameters are worthless if the tracked link is never delivered.
How does DLT URL whitelisting work?
Inventory every link
List each URL, APK link, OTT link (such as a WhatsApp click-to-chat link) and call-back number your SMS templates carry, including those inserted through variables.
Register them on the DLT portal
Add each domain or URL to the principal entity's whitelist on the operator's DLT platform, using the exact host the message will contain. Some portals then ask you to link the URL to headers or templates.
Use a shortener you control
If you shorten links, use a branded short domain registered to you and whitelist that domain; shared public shortener domains are commonly refused.
Keep tracking on a whitelisted host
Add UTM parameters or paths to a whitelisted host rather than redirecting through a different tracking domain. Check whether your portal matches on the domain or the full URL before varying paths.
Test before the campaign
Send to internal numbers on each major network and check the delivery reports; a failed DLR with a URL-related rejection code means the link still isn't recognised.
Common mistakes with DLT URL whitelisting
Using a public URL shortener
Shared short domains carry links from countless senders and are commonly refused. Register your own branded short domain and whitelist it.
Redirecting through an unlisted tracking domain
If a click tracker rewrites links to its own domain, the SMS carries a host you never whitelisted. Whitelist the tracking domain, or keep tracking parameters on a host that is already on the list.
Checking templates but not rendered messages
A
{#var#}that carries a link is still scrubbed. Validate every rendered message against the whitelist before submission, not only the template text.Applying the rule to WhatsApp
The rule governs SMS in India. WhatsApp template links go through Meta's template review instead, so don't hold a WhatsApp campaign for DLT paperwork, but do whitelist the same link if SMS is your fallback channel.
Example: A Kochi retailer's sale-day link
On the morning of a monsoon sale, a Kochi electronics retailer switches its SMS links to a new short domain so it can count clicks per store. The first batch of 40,000 promotional messages comes back almost entirely failed. The delivery reports carry the aggregator's URL-rejection code: the template was approved, but the new domain had never been whitelisted. The team whitelists its own branded short domain on the DLT portal, moves the per-store tracking into UTM parameters on that domain and adds a link check to its sending service, so the next unregistered link is stopped before submission instead of after.
DLT URL whitelisting in code
// Block any SMS whose links are not on your DLT whitelist.const WHITELIST = new Set(["abcstore.in", "go.abcstore.in", "play.google.com"]); // hosts as registered on DLTconst LINK = /\b(?:https?:\/\/)?((?:[a-z0-9-]+\.)+[a-z]{2,})(?:\/[^\s]*)?/gi;export function unlistedLinks(text) {const bad = [];for (const m of text.matchAll(LINK)) {const host = m[1].toLowerCase().replace(/^www\./, "");if (!WHITELIST.has(host)) bad.push(m[0]);}return bad;}const text = "Monsoon sale ends tonight. Shop: https://go.abcstore.in/k7 or https://tinylink.example/x9";const bad = unlistedLinks(text);if (bad.length) throw new Error(`Not whitelisted on DLT: ${bad.join(", ")}`); // stop before the operator does
Run it on the rendered message, after variables are filled in. Decide whether www. counts as the same host on your operator's portal.
DLT URL Whitelisting FAQs
- Why are my SMS with links not being delivered in India?
- Most often the link is not whitelisted on your DLT account. Since 1 October 2024 operators block commercial SMS containing URLs, APK or OTT links that are not registered, even when the template is approved; look for URL-related rejection codes in your failed delivery reports.
- Can I use a public URL shortener in DLT SMS?
- Usually not. Shared shortener domains are commonly refused for whitelisting because they carry links from many senders. Register a branded short domain that you control, whitelist it and shorten your links there.
- Do I need to whitelist every URL or just the domain?
- It depends on the operator's DLT platform: some accept a domain, others want the specific URL. Register the exact host your messages contain, and confirm how your platform matches before you vary paths or tracking parameters.
- Does URL whitelisting apply to WhatsApp messages?
- No. It is a TRAI rule for commercial SMS on DLT. Links in WhatsApp templates are reviewed by Meta during template approval, though the same link must be whitelisted if you also send it by SMS.
Best practices for DLT URL whitelisting
- Keep the whitelist in version control next to your templates and review it at every campaign launch.
- Register both the bare domain and its www. form if your portal treats them separately.
- Prefer HTTPS links on a recognisable brand domain; a strange-looking link hurts clicks even when it is delivered.
- Re-test after any change to your shortener, deep-link provider or landing-page host.