Build the domain inventory without browsing blindly

Parse HTML and text from a message you are authorized to inspect using a safe MIME/HTML parser. Extract hostnames from visible links, images, tracking pixels, unsubscribe URLs, redirect/tracking wrappers, and plain-text domains. Normalize IDNA and case, preserve the original URL in restricted evidence, and deduplicate hosts.

Do not execute JavaScript or load every resource in a browser. A message can contain internal targets, credential-bearing URLs, or malicious redirects.

Map each domain to a purpose and owner

Classify brand site, landing page, image/CDN, click tracker, unsubscribe, survey, payment, partner, user-generated content, and unknown. Record registrar/DNS/hosting owner, TLS status, redirect owner, and provider account. A branded From domain with an unrelated opaque tracker can create both trust and operational issues even when no public list reports it.

Follow redirects with SSRF controls

If redirect inspection is necessary, allow only HTTP(S) under an approved policy, resolve and reject private/reserved/local addresses, revalidate every hop, cap redirects/time/bytes, disable credentials and cookies, and use isolated egress. Do not fetch arbitrary user-provided URLs from the main application network.

Record each hop and whether parameters contain recipient identifiers. Remove unnecessary personal tracking and ensure unsubscribe links remain functional.

Query the right domain data

Use domain-specific licensed datasets. Spamhaus DBL, for example, is intended for domains found in message and connection identities, not IP addresses. Parse exact result categories and keep unavailable/not-listed distinct. Querying the final destination does not replace checking the visible tracking domain that receivers may see.

Remediate ownership and behavior

Remove unknown or compromised domains, secure registrar/provider accounts, repair redirects, and replace unapproved shared trackers. Coordinate with vendors for their domains rather than claiming ownership. Send a fresh controlled message and repeat extraction.

The report should say which domains and hops were observed and which named datasets were checked. It cannot prove a domain is trusted by every mailbox provider, and “not on a public list” is not a guarantee of inbox placement or link safety.