Safe Links and URL Rewriting: Why Email Links Change

Short answer: Many companies protect their staff with e-mail security systems that rewrite every link in an incoming message and check the destination, sometimes before the reader sees the message and again at the moment of the click. For senders, this means that links in the recipient’s copy look different, scanners may open your links automatically, click reports can include robot clicks, and one-time confirmation or unsubscribe links can be used up before a person touches them. Design your messages so that a harmless scan cannot complete an action.

What link rewriting is

Business e-mail is a favourite route for phishing, and a link that looks safe on Monday can lead to a harmful page on Tuesday. To reduce this risk, security products in company mail systems replace each link in a message with a link that goes through the security provider first. When the reader clicks, the provider checks the real destination against its current knowledge and either forwards the reader or shows a warning.

Different vendors use different names. Microsoft calls its feature Safe Links, and other providers offer similar services under their own brands. The details differ, but the principle is the same: the address in the recipient’s message is no longer the one you wrote. Often the original address is encoded inside the new one, and the new address belongs to the security provider’s domain.

What senders notice

If you send campaigns to business addresses, you may see effects that confuse your reports.

Odd links in replies and forwards. When a recipient forwards your message, the link may be the long, rewritten one.
Clicks within seconds of delivery. A scanner opens the links to test them before the human reads the message.
Many clicks on every link. Some systems follow all links, including the ones at the bottom, such as unsubscribe.
Clicks from data centres. The visits come from cloud networks and not from homes or offices.
Confirmed sign-ups that nobody confirmed. A scanner opens the confirmation link, and the address is marked as verified.
Unsubscribes that no one requested. A scanner opens the unsubscribe link and the address is removed.
Expired one-time links. The scanner uses the token, and the person who clicks later sees “link already used.”

None of this means that your mail is under attack. It means that a security product is doing its job, and your systems are treating its visits as human actions.

Why this matters

The first problem is bad data. If click numbers include robots, you may think a campaign performed better than it did, or you may send follow-up messages to people who never saw the first one. Segmenting by engagement then works from a distorted picture, which is a concern for deliverability, as discussed in engagement and inbox placement.

The second problem is broken processes. A double opt-in that completes by itself weakens the proof of consent, and an unsubscribe that triggers without a person’s intent loses subscribers you wanted to keep. Both undermine the trust that e-mail relies on. See double versus single opt-in for the reasons behind confirmation.

Design links that survive scanning

Do not let a simple visit complete an action. A web address opened by a robot should only show a page. The action, such as confirming a sign-up or unsubscribing, should need a deliberate step on that page, like pressing a button that sends a form.
Use confirmation pages. The link in the message opens a short page that says “Confirm your subscription” with a button. Scanners rarely press buttons.
Avoid single-use tokens in plain links for important actions where a scan could consume them. Where you need them, make the token valid until the final step is completed.
Support one-click unsubscribe the standard way. The list-unsubscribe header lets mailbox providers send a proper request without opening a page; see one-click unsubscribe and List-Unsubscribe. Keep a visible unsubscribe link too, with a confirmation step.
Keep link addresses simple. Long chains of redirects and unfamiliar domains make scanners and readers suspicious. See links in e-mails: tracking domains and shorteners.
Use your own branded tracking domain, set up with proper DNS and a valid certificate. Reputation attaches to domains, and a clean, consistent one helps scanners trust the link.

Clean up your reports

Treat clicks as probable, not certain. Many e-mail platforms already filter some robot clicks, but filtering is never perfect. A few practical habits improve the picture.

Look at timing. Clicks in the same second on every link of a message, or within a few seconds of delivery, are almost certainly automated.
Check the pattern per company. If every recipient at one business domain shows identical behaviour, that organisation probably uses a scanner.
Count conversions. A purchase, a booking or a reply cannot be faked by a link scanner. Use these as your real measure of success.
Be careful with open rates. Opens are unreliable for other reasons, as in Apple Mail Privacy Protection and opens.
Segment with care. Do not mark someone as highly engaged or remove them as inactive on the basis of clicks alone.

What recipients’ IT teams can do

If your own company uses such a system and it breaks legitimate workflows, administrators can often adjust it. Typical options include a list of addresses or domains that are not rewritten, a setting that keeps the original link visible and rules for trusted senders. Allowing a sender should be a careful, limited decision, because the protection exists for good reasons. If you sell to business customers and a client reports problems with your links, ask their IT contact whether the security product treats your sending domain specially, and share the sending addresses and domains that you use. Do not ask them to turn off scanning altogether.

For Microsoft 365 customers, authentication of the sender also matters, since mail that fails checks is treated more strictly; see e-mail authentication in Microsoft 365.

Test your own messages

Send a test campaign to a mailbox protected by a link scanning service, if you have access to one, or ask a client with such a system to help. Open the message and look at the links. Check what the tracking report shows, whether the confirmation or unsubscribe link worked without a human click and whether the destination pages still behave. Repeat after changes to your templates or tracking domain. A small test now avoids confusion across a whole list later.

A simple example

Consider a newsletter that asks new readers to confirm their address. The old design sends a link that confirms the subscription as soon as it is opened. A reader at a company with a link scanner never sees the message at all, because the scanner has already opened the link and the system has recorded a confirmation. The first newsletter is sent, the reader may not expect it and a spam complaint becomes more likely.

The better design sends a link to a page that says “One more step: confirm that you want our newsletter” and shows a button. The scanner opens the page and finds nothing to complete. The reader opens it later, presses the button and the confirmation is recorded with a clear, human action. The same idea applies to unsubscribing, to approving a comment by e-mail and to accepting an invitation. Whenever a message offers an action, ask what would happen if a robot opened the link ten times in a row. The answer should be: nothing important.

How Site AI Audit helps

Site AI Audit does not scan mail or change how links are tracked. It checks the e-mail authentication of your domain, together with SSL, redirects, security headers and the health of the pages your links lead to, explained in plain words and ranked by impact. A clean domain with a working website makes scanners more comfortable with your links. The first check is free, covers up to 50 pages and needs no sign-up. You can run a free check of your website or see the plans for regular monitoring.

The bottom line

Link rewriting and scanning are normal in company mail systems, and they will not go away. Accept that some clicks are robots, design confirmation and unsubscribe steps that need a real person, use a clean branded tracking domain and measure success by results that scanners cannot fake. With these habits, your campaigns stay accurate, and your subscribers keep control of their choices.

SSS

Why do my recipients see a different link than the one I wrote?

Their e-mail security system replaced it with a link that goes through the provider’s checking service. The original address is usually encoded inside the new one.

Why does my report show clicks seconds after sending?

Security scanners open links automatically to test them. Such clicks are not from people, so compare timing and conversions before you trust the numbers.

Can I stop scanners from clicking my links?

Not reliably, and you should not try to block them. Instead, make sure that opening a link cannot complete an action without a deliberate step by the person.

Does link rewriting harm deliverability?

It does not harm it by itself. But distorted click data can lead you to send to the wrong segments, which can hurt engagement signals over time.

Should I stop tracking links?

Not necessarily. Tracking is still useful for trends. Just interpret it with care, filter obvious robot clicks and rely on real outcomes such as sales or replies.