Agent WranglersEmail security Required
Send only links people can trust
Use HTTPS links on your own domain, and make the visible text match where each link goes. Never use public link shorteners.
How to do it
Link to your own domain, or a click-tracking subdomain of it. Show the address where people may want to check it, such as in a reset email. Shorteners hide the target and are often blocked by spam filters.
Example
<!-- Bad: the text and the target disagree -->
<a href="https://bit.example/x7">https://example.com/account</a>
<!-- Good: the link goes where it says -->
<a href="https://example.com/account">https://example.com/account</a>How to check
Extract every href from a test send. Each one starts with https:// on your domain, and no link text shows a different domain from its href.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/email-security/safe-links.