Do Links and Images Hurt Cold Email Deliverability?

Somewhere along the way "no links in the first email" became outbound gospel. People strip every URL out of step one, ship a naked paragraph of text, and still land in spam. Then they add a link back in step three and nothing changes. The rule wasn't wrong exactly — it was just aimed at the wrong thing.

Filters don't penalize the existence of a hyperlink. Every legitimate business email on earth contains links. What filters evaluate is the reputation of the domain behind the link, whether the visible text matches the destination, how many redirect hops sit in between, and whether the message as a whole looks like a one-to-one note or a marketing blast. Images work the same way: an image isn't a spam signal, but an email that is mostly image with a thin shell of text is.

Here's what actually moves the needle, in rough order of risk.

{"h2": "What a filter actually does with a link"}

When Gmail, Microsoft, or a gateway like Proofpoint parses your HTML, the URL gets pulled apart and checked against several things at once:

{"ul": ["Domain and URL reputation. The hostname in the link has its own history, independent of your sending domain. If it has been used in spam campaigns, sits on a blocklist like SURBL or URIBL, or was registered three days ago, that reputation gets applied to your message.","Redirect chains. Most security stacks follow the link. A URL that bounces through a shortener, then a click-tracking domain, then your actual page looks structurally like a cloaking attempt — the same pattern phishing uses.","Link/display mismatch. Anchor text that reads 'acme.com/pricing' pointing at a different host is one of the oldest phishing tells. SpamAssassin has rules for it, and so does everyone else.","Link density. Six links in a 90-word email reads like a newsletter. One link in a 90-word email reads like a person sharing something.","Whether the link domain matches your sending domain. A link to the same domain you're sending from is the lowest-risk link you can include. A link to an unrelated domain you've never sent from is not."]}

That last point is why the blanket "no links" rule half works. People who strip links stop including the thing that was actually hurting them — usually a tracking domain or a shortened URL — and credit the removal of links in general.

{"h2": "Risk ranking: what hurts and what doesn't"}

{"table": {"headers": ["Element", "Real risk", "What to do"], "rows": [["Link to your own sending domain", "Very low", "Use freely, even in step one"], ["Link to a well-known third-party domain (LinkedIn, a known publication)", "Low", "Fine, one per email"], ["Link to a brand-new domain with no sending history", "Medium", "Warm the domain first or link to an established page"], ["Click tracking through a shared or generic tracking domain", "High", "Use a custom tracking subdomain or turn tracking off"], ["URL shortener (bit.ly, tinyurl, etc.)", "High", "Never in cold email"], ["Open-tracking pixel", "Medium (and the data is junk)", "Turn off for cold; see below"], ["One inline image, small, with real text around it", "Low", "Acceptable, rarely needed"], ["Image-heavy or image-only HTML", "High", "Don't"], ["Attachment (PDF, deck, docx)", "High on first touch", "Link to it instead, after a reply"], ["One-click unsubscribe header plus a text unsubscribe line", "Lowers risk", "Always include"]]}}

{"h2": "Tracking links are the real problem, not content links"}

If you enable click tracking, your platform rewrites every URL in the email. The recipient no longer sees a link to your site — they see a link to a tracking host that then 302s to your site. That's two reputational exposures instead of one, and the tracking host is shared with every other customer on that platform unless you've set up your own.

A custom tracking domain fixes the shared-reputation part. It does not fix the redirect hop, and it introduces a new wrinkle: the tracking subdomain is usually CNAME'd to the vendor, over HTTP or with a certificate mismatch in sloppy setups, which trips rules like HTTPS_HTTP_MISMATCH. If you're going to track clicks on cold email, use a subdomain of your actual sending domain, make sure it serves valid HTTPS, and accept that the hop still exists.

Open tracking is worse value. The pixel adds a remote image load to an email that otherwise has none, and the data it produces is largely fiction — security scanners fire pixels on delivery, Apple Mail Privacy Protection preloads them, and Gmail proxies them. We've covered why in Cold Email Open Rates Are Lying to You. For first-touch cold email, turning open tracking off removes a remote asset and costs you a metric you shouldn't be optimizing against anyway.

{"h2": "Images: the cost is structural, not moral"}

Nobody's filter has an "image = spam" rule. The problems with images in cold email are mechanical:

{"ul": "**Image-to-text ratio.** SpamAssassin ships rules in the HTML_IMAGE_ONLY family that fire when the message is mostly image area with little text. The more image and less text, the higher the score. An email that is a single screenshot with 'Thoughts?' underneath is the worst version of this.","**Remote loading.** Most clients block remote images by default for unknown senders. Your carefully designed email arrives as a grey box with alt text. If the image carried the message, the message didn't arrive.","**Weight and clipping.** Gmail clips messages over roughly 102KB. Base64-embedded images blow past that fast, and the clipped portion — often including your unsubscribe line — hides behind a 'View entire message' link.","**Promotions routing.** Heavy HTML with images and multiple CTAs is a strong signal for Gmail's Promotions tab, which is a separate problem from spam and costs you just as many replies. More on that in [Why Cold Emails Land in Gmail Promotions."]}

Logos in signatures deserve a specific mention. A 15KB logo image plus three social icons means four remote assets in an email with 80 words of body text. Replace them with a plain-text signature. Nobody has ever declined a meeting because your signature lacked a logo.

{"h2": "Attachments on first touch"}

Don't. A PDF from an unknown sender to someone who never asked for it is the exact shape of a malware delivery, and enterprise gateways treat it that way — sandbox detonation, delayed delivery, sometimes outright quarantine. It also means every security scanner in the chain now opens your file, which pollutes any click or open data you're collecting. Send the deck after they reply, or host it and link to it.

{"h2": "Practical rules that work"}

{"ul": "Zero to one link in email one. If you include one, make it a link to your own sending domain — a case study page, your site, your calendar on a branded subdomain.","Never use a shortener. The hop-through is worth less than nothing in cold email.","Use the full, visible URL as its own anchor text when you can, or anchor text that honestly describes the destination. No 'click here' pointing at a redirect.","Turn open tracking off. Turn click tracking off for first touch; if you need it later in the sequence, run it through your own HTTPS subdomain.","Keep images out entirely unless the image is the point — and if it is, keep it under 50KB, host it remotely rather than embedding, and make sure the email reads fine with images blocked.","Include the List-Unsubscribe header plus one plain-text opt-out line. This is required for bulk senders at Gmail and Yahoo, and it lowers your complaint rate, which matters far more than the presence of a link.","If the body is HTML, keep it simple HTML — the differences and when each wins are laid out in [Plain Text vs. HTML."]}

{"h2": "Test it instead of guessing"}

All of the above is directional. The only way to know what your specific email does is to score it and place it. Run the draft through SpamAssassin and look at which rules fire and what they cost — anything over about 5.0 is a problem, and you'll often find that two-thirds of your score comes from a single element you can delete. Then send the same draft to a seed set across Gmail, Outlook, and a corporate domain and check where it actually lands. Add the link back, re-test, and compare. A link that costs you nothing in placement is a link you can keep.

{"h2": "Where Sendvanta fits"}

Sendvanta runs SpamAssassin scoring on drafts before you send, so you can see exactly what a tracking URL, an embedded logo, or a shortener is adding to your score and strip it before the campaign goes out. Inbox-placement tests to seed mailboxes tell you whether the version with the link still reaches Primary. Engagement classification is bot-aware, so a security scanner following your link doesn't get counted as a click — which removes most of the reason people enable aggressive tracking in the first place. One-click unsubscribe and suppression are on by default. You can see the full set at /features, and the free plan ($0 forever, 1,000 active leads, 3,000 emails/month, up to 10 of your own SMTP mailboxes) is enough to test two versions of the same email side by side before committing.

{"faq": [{"q": "Do links hurt email deliverability?", "a": "Not by themselves. A single link to a domain with decent reputation — ideally the same domain you're sending from — has little measurable effect. What hurts is shortened URLs, redirect chains through shared tracking hosts, links to brand-new domains, anchor text that doesn't match the destination, and high link density in a short email."}, {"q": "Should I include a link in the first cold email?", "a": "You can, if it's one link to your own domain and it serves the reader. Many teams get better replies with zero links in step one simply because a linkless email reads more like a personal note. Test both versions on the same segment rather than following the rule blindly."}, {"q": "Does a calendar link like Calendly hurt placement?", "a": "A Calendly or Cal.com link is a known, widely-used domain, so reputation isn't the issue. The bigger risk is that asking for a booking in email one reads as a mass send. Mention availability in text and save the link for after they express interest, or host your scheduler on a branded subdomain."}, {"q": "Is one image safe in a cold email?", "a": "One small, remotely hosted image inside a properly text-heavy email is low risk. The danger zone is image-only or image-dominant HTML, embedded base64 images that push the message past Gmail's ~102KB clipping threshold, and logo-plus-social-icon signatures that add several remote assets to an 80-word email."}, {"q": "Does disabling open tracking really improve inbox placement?", "a": "It removes one remote image load from every message, which is a small positive on its own. The larger benefit is data quality: without pixel noise from scanners and privacy proxies, your reply and verified-visit numbers actually mean something, so you stop optimizing campaigns against fake engagement."}]}

Methodology: this guidance reflects filtering behavior and SpamAssassin rule families observed in cold-email campaigns as of February 2026; specific rule scores vary by configuration, so score your own drafts rather than relying on published values.