Who scans, and when

Gmail fetches URLs as the message is filtered, before it is placed. Microsoft Defender SafeLinks rewrites every link to safelinks.protection.outlook.com and fetches the original at click time — and again on a schedule for known-bad checks. Proofpoint URL Defense and Mimecast URL Protect do the same rewrite-and-fetch at gateways. Then Slack, LinkedIn and mail clients fetch again to build a preview card when the link is shared or forwarded. Each fetch is a full request with its own user-agent, and each one records what it found.

What a scan looks at

The redirect chain first: how many hops, whether any cross domains, whether any downgrade from HTTPS to HTTP, whether a shortener is involved. Then the final domain: age, blocklist status, whether a real site exists at the apex, whether the tracking subdomain points at shared sending-tool infrastructure. Then the response: security headers, TLS, mixed content, and whether the visible link text names a different domain than the target — the phishing signature every scanner checks. Then the page: title, Open Graph tags, forms, scripts that redirect.

Why it matters for cold email

Copy and authentication decide whether the message is trusted; the link decides whether the destination is. A message that passes SPF, DKIM and DMARC, from a warmed domain, with a link that hops through a week-old tracking domain to an http:// page with no headers, is still a message with a bad link in it — and Gmail treats a bad link as a bad message. The fixes are all on the destination side and none needs the sending tool: one hop, your own tracking domain, HTTPS end to end, a real page with headers and Open Graph tags.

Side effects

Scanner fetches register as opens and clicks in the sending tool. SafeLinks in particular clicks every link in every message, which is why click rates from Microsoft-heavy lists look inflated and why open tracking is unreliable. Treat engagement metrics from tools as directional, and never trigger a follow-up on a click alone.

Check yours

These run free in your browser or from the edge. Nothing is stored.

Common questions