Link Analysis and Remote Images
What PressedMail checks before you click a link, and why remote images stay dark until you say otherwise.
Two things in an email reach outside your server: links you click, and images the message asks your browser to fetch. Both are handled at render time, before anything is on screen.
What the link analyser checks
Seven checks run against every anchor while the message is being sanitised. No lookup leaves your server, so nothing is told which mail you are reading.
- Dangerous scheme. A
data:URI, which can carry executable content. - URL shortener. Thirteen known shortener domains, including bit.ly, t.co, tinyurl.com and lnkd.in.
- Raw IP address used in place of a hostname.
- Lookalike domain. A map of twenty-six entries catches the substitutions phishing kits actually use: a digit one standing in for a letter l, an r and an n together reading as an m, and similar. The map holds the real brand domains, so the examples here use reserved ones:
examp1e.comagainstexample.com, orexarnple.comagainst the same. - Suspicious top-level domain. Ten of them, among them
.xyz,.top,.click,.tkand.cf. - Non-standard port. Anything other than 80 or 443.
- Text disagreeing with destination. The visible text says one domain, the
hrefgoes somewhere else. A subdomain of the visible domain is fine; an unrelated host is not.
A link that trips any of these is rewritten to point at a warning page that names the reason before it hands you the real destination. That interstitial is a site setting and it is off out of the box, so an administrator turns link warnings on.
What happens to the HTML regardless
Link checks sit on top of sanitisation, which always runs. Scripts, iframes, objects, embeds, applets and forms are stripped on the server. Link protocols are limited to http, https, mailto, tel and cid. Every surviving anchor gets target="_blank" and rel="noopener noreferrer ugc nofollow". The result renders inside a sandboxed iframe with no script permission, under a policy of default-src 'none' and script-src 'none'.
Remote images stay off
Images are blocked by default. Blocked images are swapped for a transparent placeholder that keeps the original URL in a data attribute, so the layout survives and the sender learns nothing.
Tracking pixels get special treatment. Any image two pixels or smaller in both dimensions is neutralised in every mode, including after you choose to show images. Spacer graphics with one real dimension are left alone. Inline attachments, cid: and data: sources, always render because they are already in the message.
The proxy, when images are shown
On paid builds a shown image does not load from the sender's server. The renderer signs a short-lived URL, one hour by default, and your browser asks PressedMail for the bytes instead. The proxy then:
- refuses anything that is not
httporhttpson port 80 or 443, and requires every resolved address to be public, so internal hosts are unreachable; - sends no cookies and a blank referrer;
- rejects a response larger than 5 MB;
- accepts PNG, JPEG, GIF, WebP and SVG only, verified by magic bytes when the upstream content type is wrong;
- serves the bytes with
nosniff,no-referrerand a private one-hour cache.
The Free build has no proxy. There, direct HTTPS images load when you show them and everything else stays blocked.
The three controls
- Per message. Show images once, for the message in front of you.
- Per user. Turn on Automatically load remote images in your own security settings. It is off by default.
- Site-wide. An administrator can switch external images off for everyone. That wins over both of the above.
Read Next
Phishing Detection and Reports
How PressedMail scores a suspicious message, which signals it weighs, and what the safety report actually shows you.
Mailbox Lock and Impersonation
Put a second passphrase in front of your mail, and keep an administrator who switches into your account out of it.