Do URL shorteners hurt email deliverability? We tested

Ask whether URL shorteners hurt email deliverability and most guides, one of ours included, will say they "add spam points". We wanted a number. On October 28, 2026 we built ten link variants of two emails, a normal issue and a short promo, and scored each one in stock SpamAssassin, the open-source filter that cPanel servers and plenty of self-hosted mail gateways run. The answer depends on which shortener, how long the email is, and whether you mean SpamAssassin or Gmail.

The short answer on URL shorteners and email deliverability

For bit.ly, no, at least not in a content filter. A bit.ly link in a normal 400-word issue scored 0.0 in every mode we ran. TinyURL is a different story. One rule, FSL_HAS_TINYURL, matches any tinyurl.com link and adds 3.399 points. SpamAssassin's default spam threshold is 5.0, so a single TinyURL link uses up two-thirds of your margin before the filter reads a word.

Short emails are the other trap: a one-image promo scored 1.2 with a full URL and 3.7 with the link shortened, once network tests were on. Gmail is a separate question, and the evidence there is anecdotal.

What SpamAssassin's shortener rules score

The shortener rules live in 25_url_shortener.cf. The copy sa-update installed on October 28 (ruleset 1939515) lists 241 shortener domains, plus tr.ee as a special case. Some entries are surprising. Mailchimp's eepurl.com and Constant Contact's conta.cc are on it. So are youtu.be, amzn.to, lnkd.in and t.co. Paste a YouTube share link into a newsletter and SpamAssassin counts it as a shortener.

A match sets an internal flag, __URL_SHORTENER, worth nothing by itself. Only two rules in the file carry a score, and both need the DecodeShortURLs plugin, which follows each short link over HTTP to see where it lands:

• URL_SHORTENER_CHAINED adds 0.01 when a short link redirects to another shortener.
• URL_SHORTENER_DISABLED adds 2.0 when the link lands on bitly.com/a/blocked or tinyurl.com/app/nospam, the pages those services show after they kill a link for abuse.

Here is the catch. Ubuntu 24.04's SpamAssassin package ships that plugin commented out in /etc/spamassassin/v400.pre. On a stock install, neither rule exists.

The points that do land come from other files that read the flag. SHORTENER_SHORT_IMG adds 2.5 when a shortener sits in HTML under 1,024 bytes with a linked image, but only in the score sets used when network tests run (0.001 otherwise). GB_FAKE_RF_SHORT adds 1.0 when the subject starts with a fake Re: or Fwd: and the body has a shortener. If your team likes reply-style subject lines, run them through our subject line tester before they ship. FSL_HAS_TINYURL is not in the shortener file at all. It is a one-line regex in 72_active.cf, scored 3.399 in all four score sets.

Three scam rules (MONEY_FRAUD_3, MONEY_FRAUD_5, PDS_NO_FULL_NAME_SPOOFED_URL) even stay quiet when a shortener is present. The ruleset has no grudge against shorteners in general. It goes after TinyURL, short image promos and fake replies.

Our test: ten link variants, two email shapes

We built one 400-word issue as a multipart/alternative message with matching HTML and text parts, a List-Unsubscribe header and one call-to-action link, then swapped only the link. Three more variants are a short promo: one linked 600-pixel image and a one-line text part. Everything ran in a throwaway Docker ubuntu:24.04 container with SpamAssassin 4.0.0, the same setup as our plain-text version test. Each message was scored three ways: local rules only, with network tests (Bayes off), and with network tests plus DecodeShortURLs loaded.

Variant	Local only	Network	Network + plugin	Rule that moved
1. Full URL to our own domain	0.0	0.0	0.0	none
2. bit.ly	0.0	0.0	0.0	none
3. tinyurl.com	3.4	3.4	3.4	FSL_HAS_TINYURL
4. Branded short domain (nyti.ms style)	0.0	0.0	0.0	none
5. Mailchimp click tracking (list-manage.com)	0.0	0.0	0.0	none
6. eepurl.com (Mailchimp's shortener)	0.0	1.1	0.0*	URIBL_GREY
7. Disabled bitly link	0.0	0.0	2.0	URL_SHORTENER_DISABLED
8. Short image promo, full URL	6.1	1.2	1.2	baseline
9. Short image promo, bit.ly	6.2	3.7	3.7	SHORTENER_SHORT_IMG
10. Short image promo, youtu.be	6.2	3.7	not run	SHORTENER_SHORT_IMG

*The URIBL reply timed out in this run; see the next section.

These are content scores only: no DKIM signature and no Received headers, so no authentication credit and no IP checks. Our short links used made-up paths that returned 404 when DecodeShortURLs followed them, so variant 7 carries the blocked-page URL directly.

With local rules only, the short promo scored 6.1 even with a full link, because an image-only HTML part next to a different text part trips MPART_ALT_DIFF and HTML_IMAGE_ONLY_04. With network tests the base drops to 1.2, and the shortener alone triples it. A YouTube link did exactly the same.

Are bit.ly and TinyURL on Spamhaus DBL or URIBL?

No. On October 28 at 18:00 UTC we queried Spamhaus DBL, URIBL and SURBL through a private resolver, after checking that each list answered its own test entry (dbltest.com returned 127.0.1.2, test.uribl.com 127.0.0.14, test.surbl.org 127.0.0.254). Public resolvers get refused or fed false answers by these lists, a trap we covered in why your blacklist check lies. bit.ly, bitly.com, tinyurl.com, is.gd, t.co, lnkd.in, ow.ly, buff.ly, cutt.ly, rb.gy, shorturl.at, tiny.cc, rebrand.ly and conta.cc all came back NXDOMAIN on all three lists. Not listed.

The listings we found were ESP domains. URIBL returned 127.0.0.4, its grey list, for Mailchimp's eepurl.com and list-manage.com, SendGrid's sendgrid.net and ct.sendgrid.net, and MailerLite's mlsend.com. URIBL defines grey as "domains found in UBE/UCE, and possibly honour opt-out requests", and warns it will cause false positives. SpamAssassin scores URIBL_GREY at 1.084 with network tests and 0.424 once Bayes is trained. Spamhaus has a return code for abused legitimate redirectors, 127.0.1.103, and SpamAssassin scores it at 0.001.

Mailchimp click links mostly escape the grey listing. SpamAssassin's 20_aux_tlds.cf treats us1 through us21.list-manage.com as if they were top-level domains, so a tracked link is checked against the sender's own account host, not Mailchimp's shared domain. That is why variant 5 scored 0. eepurl.com gets no such treatment: it is on the shortener list and on URIBL grey.

TinyURL and t.co sit on SpamAssassin's uridnsbl_skip_domain list, so they are never looked up. And our resolver dropped about half the URIBL queries: every direct eepurl.com answer was grey (4 of 4), but SpamAssassin's lookup arrived in time in one run of seven, which scored 1.1. A server with a steady resolver gets the 1.1 every time.

What Gmail does with shortened links

This is where the folklore came from, and it is not baseless. In July 2021 two deliverability people reported the same pattern a week apart. Al Iverson at Spam Resource (July 21) saw forum reports of Gmail spam-foldering and blocking mail that referenced bit.ly, and his own testing, which he called "very non-scientific", agreed. Brian Kerr at Postmark (July 28) traced a run of Gmail blocks for customers, with the bounce text "Our system has detected that this message is suspicious due to the nature of the content and/or the links within", to free shorteners, mostly bit.ly. Removing them brought delivery back to normal.

Neither post has numbers, a sample size or a control group, and both are more than five years old. We cannot measure Gmail either: there is no rule file to read, and a test send to a few inboxes proves little about a filter that weighs your sending history. Treat the Gmail risk as real but unmeasured.

Where URL shorteners do hurt email deliverability

Put the two halves together and the cost is not a fixed penalty. It is reputation you do not control. A bit.ly link carries bit.ly's standing with Gmail, and everyone who shortens anything sets that standing, phishers included. When a spam wave runs through bit.ly, your newsletter is in it.

The smaller costs add up too:

• The shortener can switch your link off. Readers get a warning page, and filters running DecodeShortURLs add 2.0.
• Readers who hover see bit.ly/4hQx2Lm, not your domain, which is what a phisher shows them.
• Your ESP wraps the short link in its own redirect, so every click takes an extra hop and the ESP report lists the shortener as the destination.
• Bitly counts clicks too, by its own rules, so two dashboards disagree.

Our view: "never use shorteners in email" is right, and the reason usually given for it is wrong. A content filter will not punish a bit.ly link in a normal newsletter. Gmail might, and you will never see the rule that did it. Our own guide to how spam filters score your newsletter said shorteners add points across the board. That was wrong for bit.ly and too vague about TinyURL, and we corrected it on October 28.

What to use instead of a public shortener

Link the full URL in the HTML and let your ESP wrap it. Nobody sees the URL behind a button, so length costs nothing there. In the text part a long UTM-tagged URL looks clumsy but does no harm. Link count is a separate question, covered in how many links a newsletter should have.

Want your own domain on every link? There are two options, each with a cost.

A custom click-tracking domain points a subdomain such as links.yourbrand.com at your ESP's tracking servers, so your links carry only your reputation. The cost is a DNS record, HTTPS setup on the ESP side, and a domain that starts with no history. Our click-tracking domain guide covers the shared versus custom tradeoff.

A branded short domain, the way The New York Times uses nyti.ms, scored 0.0 in every mode. It earns its keep in SMS, print and QR codes, where characters matter. In an email it is one more domain to renew and one more redirect.

And if you must use a public shortener, the test leaves three rules. Never TinyURL. Never in a short image-only promo. Never inside a link your ESP already tracks.

Start with your last three issues: search the HTML for tinyurl.com, bit.ly and youtu.be. If TinyURL shows up, fix that first. It costs 3.4 points on any server running current SpamAssassin rules. Choosing a pre-send testing tool? See how Newsletrix and Litmus split the work.

Frequently asked questions

Do bit.ly links send emails to spam?

Not in SpamAssassin. In stock SpamAssassin 4.0.0 with the October 28, 2026 ruleset, a bit.ly link in a normal-length newsletter scored 0.0, with and without network tests. The risk is at Gmail: in July 2021 Postmark and Spam Resource both reported Gmail blocking or spam-foldering mail with bit.ly links, because of the shared domain's reputation. Neither published numbers.

Does SpamAssassin penalize URL shorteners?

Only in specific patterns. Any tinyurl.com link triggers FSL_HAS_TINYURL for 3.4 points. A shortener in a short HTML email with a linked image triggers SHORTENER_SHORT_IMG for 2.5 points when network tests run, and a fake Re: or Fwd: subject with a shortener adds 1.0. A bit.ly link in an ordinary newsletter scores nothing.

What is URL_SHORTENER_DISABLED in SpamAssassin?

It is a 2.0-point rule that fires when a shortened link redirects to bitly.com/a/blocked or tinyurl.com/app/nospam, the pages those services show after disabling a link for abuse. The rule only exists when the DecodeShortURLs plugin is loaded, and Ubuntu 24.04 ships that plugin commented out in /etc/spamassassin/v400.pre.

Is a branded short link safer than bit.ly?

For reputation, yes. A domain only you use cannot be dragged down by other people's spam, and in our test a branded short domain scored 0.0 in every mode. The cost is a domain to buy and renew that starts with no history.

Should I shorten links inside ESP click tracking?

No. Your ESP already rewrites every link through its tracking domain, so a shortener adds a second redirect, shows the shortener instead of your page in the ESP's click report, and brings a public shortener's reputation into a link that was otherwise clean. Link the full URL and let the ESP wrap it.

Related reading