First, we have an app and our domain supports Universal links on iOS9 and iOS10. On the landing page there is an element with 'href' attribute set to our domain. Clicking on it launches our native app or opens UL in the browser. This is working.
However when the same landing page is put inside an iframe(expected use case) that button doesn't work as expected. Instead of launching our app I can see in the Consoles: "https://domain/path/page.html" was not allowed to display insecure content from itms-appss://itunes.apple.com/app/appname/id#######?mt=8. Which means that UL mechanism didn't work and the browser actually retrieved the URL (which in turn is a simple PHP file sending the Location header redirecting to iTunes)
I thought may be there was something with our app or the page or the subdomain so I tried to add similar links for Instagram app. That didn't help because behavior was the same: UL mechanism didn't work and browser retrieved contents of the UL.
Pseudo-HTML:
<body>
<a href="universal_link">Works</a>
<iframe src="your_random_local_page.html">
<a href="universal_link">Doesn't work</a>
</iframe>
</body>