When are custom thresholds worth it for Every link goes where it should?
When are custom thresholds warranted?
Set `fetchAccountActionLinks` to `true` for transactional and operational mail where the action link *is* the message — a password reset whose link is broken is a complete failure, and skipping it to be safe means never testing the only thing that matters. Use `approvedLinkDomains` when you want destinations restricted to your own properties and approved partners, which catches agency and affiliate links nobody sanctioned. Tighten `allowedSchemes` to `https` alone when your policy forbids insecure links.
When should you stay on Standard?
Leave `fetchAccountActionLinks` off for marketing mail — the risk of triggering a real opt-out or account action for a real subscriber outweighs the coverage you would gain. Keep `approvedLinkDomains` empty when auditing sends you did not build, since someone else's legitimate destinations are not yours to fail. Keep `maxRedirectHops` at the specification cap unless you have a documented reason, because a lower value fails links that browsers follow perfectly well.
What do you trade away?
Enabling action-link fetching is the consequential override: on a real recipient's message it can perform the action the link exists to perform, which is why it is framed as your assertion that no real person's account sits behind those links. A configured domain list means every new legitimate destination fails until the list is updated, and lists maintained under deadline pressure tend to be widened rather than corrected. Lowering the redirect cap catches sloppy chains but will also fail long-established shortener stacks that work.
Community Standard vs org Custom
The Standard configuration transcribes outside authority where it exists — the Fetch specification's redirect cap, the safe-method discipline that governs machine fetching — and defaults to caution where it does not. The action-link flag is best treated as a per-send assertion made by someone who knows what is behind those links, not a global setting quietly switched on once. An approved-domain list is your own policy and belongs with whoever owns campaign destinations and tracking infrastructure.
Worked override examples
A team auditing password-reset mail in a test environment sets `fetchAccountActionLinks` to `true`, since every link in the message is an account action and skipping them would test nothing. A brand consolidating tracking sets `approvedLinkDomains` to its own domains plus its single approved click-tracking domain, so an agency's own shortener fails until it is either sanctioned or removed. A security-conscious sender sets `allowedSchemes` to `["https"]`, turning any surviving plain-http link into a failure rather than a footnote.
How does an agent call it with parameters?
{
"type": "email",
"validations": [
{
"id": "email-link-integrity",
"parameters": {
"approvedLinkDomains": [],
"allowedSchemes": [
"https",
"http",
"mailto",
"tel"
],
"maxRedirectHops": 20,
"fetchAccountActionLinks": false
}
}
]
}