URL Categorization for Email Security Products
Most phishing and malware attacks still arrive as a link in a message. Before your product can judge a link, it needs to know what kind of site sits behind it.
This guide is for teams building secure email gateways, cloud email security, mail clients and security awareness tools. It covers the categories that matter, when to check links, and how to wire category data into a risk score.
Please review the updated invoice before Friday.
short-link.example/x7QpURL Shortenerfiles-share.example/docFile Hostinginvoice-portal-login.examplePhishingvendor-company.exampleBusinessWhat email security products use URL categories for
Category data does more in email than block bad links. It shapes risk scores, drives policy rules, explains decisions to users and powers the reports security teams send upward.
Link risk scoring
Categories feed the score for each link alongside domain age, sender reputation and message signals.
Policy rules
Admins write rules such as "hold external mail that links to file hosting" or "strip links to gambling sites".
Sender website checks
A sender domain whose website is parked or brand new deserves more caution than an established business site.
User warnings
A warning that says "this link goes to a file sharing site" is clearer than a generic risk banner.
Reporting
Weekly reports by category show which link types reach users and which were stopped.
Awareness training
Training tools use real category patterns to explain which links are risky and why.
Data loss rules
Outbound mail linking to personal file hosting or AI tools can be flagged for data protection review.
Marketing mail review
Bulk senders and email platforms check outbound campaigns for links to restricted categories.
Which categories matter most in email
Email risk sits in a small set of categories, while many others help with policy and reporting. The weight bars show how much each category typically contributes to a link risk score. Definitions are on the category list.
| Category | Why it matters in email | Typical risk weight |
|---|---|---|
| Malware / Phishing / Suspicious | The direct signal. Links here are blocked or rewritten in nearly every product. | |
| Parked / For-Sale Domains | Parked domains in links are rare in real business mail and often precede an attack once the domain goes live. | |
| URL Shorteners | Hide the true destination. Expand them and score the target, and add weight when the target cannot be resolved. | |
| Cloud Storage / File Hosting | Trusted platforms are often abused to host payloads and fake login pages. Score with the path and sender context. | |
| Web-based Applications | Form builders and site builders host many credential harvesting pages under trusted domains. | |
| Remote Access Tools | Support scams send links to remote access downloads. Unusual in normal mail to most users. | |
| Cryptocurrency | A frequent theme in investment scams and fake giveaways. | |
| Gambling, Adult, Dating | Mostly a policy and spam topic in business mail, and a common lure theme. | |
| Online Banking, Financial Services | Legitimate banks are low risk themselves, but lookalikes of them are prime phishing targets. Use for brand protection checks. | |
| Business, News/Media, Government & Legal | Lower the score for links to established sites in these categories, which most real business mail contains. |
Delivery time, time of click, and after the fact
A link can be harmless when the message arrives and harmful an hour later. Email products check at several moments, and each moment has different speed and data needs.
Score every link
- Extract and normalize all links
- Look up each domain locally
- Combine with message signals
- Deliver, rewrite, hold or quarantine
Check again
- Rewritten link calls your check service
- Re-score with current data
- Allow, warn or block in the browser
- Log the click for reporting
Look back
- Daily deltas change some labels
- Search delivered mail for affected domains
- Pull or flag messages in mailboxes
- Alert the security team
Combining categories with other signals
Categories are one input to a link decision. These are the signals email products usually combine them with, and the role category data plays among them.
From category data
- Primary category strong signal
- Secondary categories mixed-use sites
- Parked status strong signal
- Shortener or redirect expand first
- Content category of sender site context
From the message and your systems
- Sender authentication results strong signal
- Domain registration age strong signal
- Lookalike of a known brand strong signal
- First contact with this sender context
- Your own threat intelligence strong signal
Offline database, API, or both
Mail volume is high and message content is sensitive. Those two facts push most email products toward a local database, with the API filling gaps. Smaller products and add-ins often start on the API and move to the database as volume grows.
Offline database
Full file inside your mail platform or gateway.
- Scores millions of links without external calls
- Message data never leaves your systems
- Works on-premise and air-gapped
- Daily deltas keep it current
Lookup API
Calls from your scoring service for each new domain.
- Quick start for new products
- Single and batch lookups
- Good for time-of-click checks at low volume
- Send domains only, never full links
Both
Local file for delivery scoring, API for the rare miss.
- Fast delivery-time decisions
- Full coverage of the long tail
- One delta job updates every node
- The usual production layout
Update cadence: regular refreshes
Attackers often register a domain, use it within days and abandon it. Email products need the fastest part of the update stream more than most, so plan the daily job first and the monthly reload second.
- Daily
About 300,000 newly registered domains are categorized each day and delivered as delta files. Apply them to every scoring node and run the look-back search.
- After one week
New domains are checked again, because many sites add content after launch. A parked domain that turns into a login page shows up here.
- After one month
A second recheck catches slower changes in purpose.
- Monthly
All other domains are refreshed. Reload or merge the full file on a schedule.
- Your cache
Keep time-of-click cache lifetimes short for risky categories and longer for established business sites.
Integration steps
These steps take category data from a licensed file into a working link scoring pipeline. Most teams build them in this order, with the scoring model and policy rules shipped before click-time checks.
Extract every link
Pull links from HTML bodies, plain text, buttons and attachments where you parse them. Include links hidden behind images.
Normalize and expand
Reduce each link to host and registered domain. Expand known shorteners and redirects to reach the final destination.
Load the database
Import the CSV, Parquet or JSON file into the store your scoring service reads, keyed by domain with ranked categories.
Add categories to the score
Feed primary and secondary categories into your risk model as features, alongside your other signals.
Expose policy rules
Let admins act on categories directly: rewrite, warn, hold or strip links for chosen categories.
Wire time-of-click
Point rewritten links at a check service that re-reads current categories before redirecting the user.
Run the delta and look-back jobs
Apply daily deltas, then search recent mail for domains whose category changed to a risky one.
Explain decisions
Show the category in warnings and admin logs, so users and analysts understand every block.
Tricky link patterns and how categories help
Attackers prefer links that look harmless at first glance. These patterns come up constantly, and each one needs a slightly different use of the data.
Trusted platform, bad page
A phishing form hosted on a well-known file host or site builder. The domain category is benign; add weight for the category type and check the path where you can.
Chain of redirects
A shortener leads to a tracker, which leads to the payload. Score the final hop, and treat a chain that ends on a brand-new domain as high risk.
Sleeping domain
A link to a parked domain at delivery that becomes a login page days later. Time-of-click checks and look-back searches catch it.
Lookalike sender site
The sender's domain resembles a bank, but its website is parked or new. A category check on the sender domain adds strong context.
QR codes in attachments
Links inside images escape plain text scanning. Decode QR codes where you can and run the same category checks on them.
Legitimate newsletter, risky link
Mixed-content newsletters link to dozens of sites. Category rules let admins strip only the restricted ones instead of blocking the whole message.
Email product types and their category needs
Email security is not one product. Each type sits at a different point in the mail flow and leans on different parts of the category data.
| Product type | Where it sits | Main category use | Data layout |
|---|---|---|---|
| Secure email gateway | In the mail flow, before the mailbox | Delivery-time scoring, link rewriting, policy rules | Full local database on each gateway node |
| API-based cloud email security | Connected to the mailbox platform after delivery | Post-delivery scanning, look-back, pulling messages | Central database, daily deltas, API for misses |
| Mail client or add-in | On the user's device | Warnings at open and click time, link previews | Small local index plus your backend |
| Security awareness platform | Training and reporting | Explaining risky link types, scoring reported messages | API or central database |
| Email service or marketing platform | Outbound sending | Checking customer campaigns for restricted or risky links | Central database with batch checks |
Privacy and deployment questions customers will ask
Email holds a company's most sensitive data. Security reviewers will ask exactly where links go during scoring, so design the answers in.
Links stay in your platform
With the licensed database running locally, link scoring needs no outside calls. Message bodies and full URLs never leave your systems.
Domain-only lookups
Where you use the API, send only the domain. Paths and query strings in email links often carry personal data or tokens.
Regional and air-gapped
Files can be deployed in each region you host mail in, and in air-gapped environments for government and defense customers.
Testing the link pipeline
Run these checks on every data load and every model change. Automate them so a missed delta or a broken rule shows up before customers notice.
- Known categories
A fixed set of test domains per category returns the expected labels from the local store.
- Fresh domains
A sample of domains from the latest daily delta is found in every scoring node.
- Shortener expansion
Test short links resolve to their targets, and the target's category drives the score.
- Click-time re-score
Changing a test domain's label changes the click-time decision without redelivery.
- Look-back
A relabelled domain finds the test messages that contained it.
- Warnings
User warnings show the right category name in every supported language.
Licensing for email security vendors
Category data inside an email product you sell is an embedded use. The OEM licensing page explains how it works, including group-wide options for vendors with several security products.
OEM / embedded
The data runs inside your gateway, cloud service or client. Customers see categories in warnings, rules and reports, not the raw file.
Group-wide
For security vendors with email, web and DNS products. One licence can cover the product family.
Pricing
Starter database tiers from $999; enterprise and OEM licences are quoted per deployment. See pricing. Resale or publication of the raw data is not allowed.
Email security URL categorization FAQ
How does URL categorization help email security?
Every link in a message points to a domain with a category. Categories such as Malware / Phishing / Suspicious, Parked / For-Sale Domains, URL Shorteners and Cloud Storage / File Hosting are strong signals in a link risk score, and content categories help with policy rules and reporting.
Should links be checked at delivery or at click time?
Both. A delivery-time check scores every link before the message reaches the inbox. A time-of-click check runs again when the user opens the link, which catches domains whose category changed after delivery.
Is category data enough to detect phishing on its own?
No. Categories are one strong signal among several. Email security products combine them with sender authentication, message content, domain age and their own threat intelligence before deciding.
How fresh does the data need to be for email?
Very fresh, since many phishing domains are used within days of registration. About 300,000 newly registered domains are categorized every day as daily delta files, rechecked after a week and a month, and all other domains get regular monthly refreshes.
Can the data run inside our own mail infrastructure?
Yes. The database is delivered as files that run inside your own systems, including on-premise and air-gapped deployments, so message content and links never leave your platform. A lookup API is included for domains the local copy does not hold.
Which licence fits an email security vendor?
An OEM licence, because the data runs inside a product sold to customers. Resale or publication of the raw data is not allowed.
How do we handle links to large trusted platforms?
Treat the platform's category as context rather than a verdict. File hosts, form builders and site builders are useful services that attackers also abuse, so combine their category with the path, the sender and domain age before deciding.
Can categories reduce false positives?
Yes. Links to established sites in categories such as Business, News/Media or Government & Legal can lower a link's score, which helps keep normal business mail flowing while risky links get closer attention.
What should happen when a link's domain has no category?
Treat it as a signal in itself. An unknown domain in an external message, especially a very new one, deserves a higher score, a click-time check and a fresh lookup once the next daily delta arrives.
Does the data include the IAB Content Taxonomy?
Yes. The same file includes the IAB Content Taxonomy alongside the 59 web filtering categories, which some email marketing and reporting features use for finer content labels.
Can we use the categories in outbound mail rules?
Yes. Outbound rules can flag messages that link to personal file hosting, AI tools or restricted categories, which supports data protection and acceptable use policies.
Give every link in the inbox a category
Tell us about your mail volume, deployment model and scoring pipeline. We will suggest the data layout and licence that fit.
License the database OEM licensing