What Gmail, SafeLinks and Slack See When They Fetch Your Link
The link in your cold email is opened several times before the prospect sees it. Gmail's scanner fetches it as the message arrives. If the prospect is on Microsoft 365, SafeLinks rewrites it and fetches it at click time. Proofpoint or Mimecast fetch it if the company has a gateway. Then the prospect pastes it into Slack to ask a colleague, and Slack fetches it too. Each of those fetches reads things a human never sees, and each one scores the destination. Here is what they read and what to do about it.
Fetch one: the redirect chain
The first thing every scanner does is follow the URL to wherever it ends. A tracking link that hops through the sending tool's shared domain, then a shortener, then an http:// landing page, then a 301 to the https:// version is four hops and two reputations that are not yours. Scanners weight chain length, cross-domain hops, temporary redirects and any HTTPS-to-HTTP downgrade. One hop, same organisational domain, permanent, HTTPS end to end is what an established site looks like. The redirect checker walks the chain the way a scanner does and grades each hop.
Fetch two: the headers
When the scanner reaches the final page it reads the response headers before the body. HSTS with preload, a Content-Security-Policy, framing protection, a referrer policy and cookies with Secure and SameSite flags are what a page set up by someone who maintains it sends. A landing page with none of them, a leaking X-Powered-By and mixed content reads like a page set up in an afternoon — which, for most tracking and landing domains, it was. None of this takes more than one rule on Cloudflare.
The security headers checker grades a page the way this chart does — on what the headers actually do, not whether they exist — and hands you the block to paste. HSTS with a year's max-age, nosniff, X-Frame-Options, a referrer policy and a permissions policy are five static headers with no downside. A CSP is the sixth and the one to roll out as report-only first.
Fetch three: what the page says about itself
Slack, LinkedIn, iMessage and most mail clients build a preview card from the page's Open Graph tags: og:title, og:description, og:image. A page with them unfurls into a card with a picture; a page without unfurls into a bare URL, which is what a prospect's colleague sees when asked "is this legit?". The image has rules — absolute HTTPS URL, at least 1200×630, PNG or JPEG under a few hundred kilobytes — and each platform falls back differently when a tag is missing. The link preview checker renders the four cards and fetches the image to measure it.
What the scanner already knew
Before any fetch, the scanner has the domain: how old it is, whether it is on a blocklist, whether it has a website at all, whether the tracking subdomain resolves to the sending tool's shared infrastructure. A tracking domain registered last week with no site behind it scores badly regardless of what the page says. Age cannot be bought, but the rest can be fixed in an hour: a real page at the apex, a www that resolves, a custom tracking domain on your own name instead of the tool's, and no shortener anywhere in the chain.
The single highest-leverage change is removing the shared tracking domain. Every other customer of the sending tool shares that reputation with you, including the ones who send badly. A click domain on your own subdomain, CNAMEd to the tool, is one DNS record and a checkbox.
The ten-minute version
Run the link through the redirect checker; collapse to one hop. Run the destination through the headers checker; paste the block into a Transform Rule. Run it through the preview checker; add the three OG tags and an image. Confirm the tracking domain is yours. That is the whole list, and it moves a landing page from the "unknown domain, no headers, bare link" bucket into the one the scanners leave alone.
Sources
- Safe Links in Microsoft Defender for Office 365 — Microsoft
- The Open Graph protocol — ogp.me
- HSTS preload list submission — Chromium
Tools for this
Redirect checkerTrace a redirect chain to its final URL.Security headers checkerHSTS, CSP, cookies and the rest, graded.Link preview checkerHow a link unfurls, and what is missing.Tracking domain checkerVerify a custom click domain end to end.Frequently asked questions
Do link scanners count as opens or clicks?
Yes, which is one reason open and click numbers from cold email tools are unreliable. SafeLinks in particular fetches at click time and again on a schedule.
Will adding security headers break my landing page?
HSTS, nosniff, X-Frame-Options, Referrer-Policy and Permissions-Policy almost never do. Content-Security-Policy can block a script you rely on, so deploy it as report-only for a day first.
Why does Slack show a bare link for my page?
It found no og:image, or the image is a relative path, served over http, under 600×315, or an SVG. The preview checker fetches the image and says which.
Should I stop using tracking links entirely?
Click tracking on your own domain is fine. Open-tracking pixels are a bulk-mail pattern and Apple Mail Privacy makes the numbers meaningless; I turn opens off for cold outreach.
How old does a domain need to be before scanners trust it?
There is no fixed threshold, but under thirty days is visibly penalised and ninety days with a real site behind it is where most of the age effect has worn off. Buy landing and tracking domains early.