Deliverability Risk Scanner

A single suspicious link, a block of capitals or an executable attachment can stop an otherwise good email from reaching the inbox. This free scanner checks a plain-text email for those avoidable signals — link count, shorteners, domain spread, shouting, attachment types and unresolved placeholders — and returns a prioritised risk score. Everything runs in your browser, and the email is never uploaded or stored.

What this deliverability risk scanner checks

Deliverability is usually discussed in terms of authentication and domain reputation, but plenty of emails are weakened by the message itself. A first cold email with nine links, a subject line in capitals and an executable attachment is asking for trouble before the sending infrastructure is even considered.

This scanner reads a plain-text email and scores the avoidable, message-level risk signals in four groups: links, formatting, attachments and content. The result is a 0–100 risk score where a higher number means more risk, a status word, category meters, and a list of findings ordered from most to least serious. It is a pre-send checklist, not a spam-filter simulator and not a prediction of inbox placement.

How to use the scanner

1. Paste the subject line into the optional Subject line field. It is used for the all-caps subject check, the placeholder scan and the caps count.
2. Paste the plain-text body into Email body. This is the field that is actually scanned for links and content.
3. List any files you plan to attach in Attachment filenames, separated by commas. Only the name and extension are checked.
4. Read the Risk score first: the number, the status word and the short explanation. Then open the Risk breakdown to see which category produced the points.
5. Work through Findings, worst first. Items tagged Fix are the strongest signals; Watch items are worth tidying; Tip items are optional polish.
6. Check Links and attachments to confirm the scanner read the URLs and filenames you expected. Correct the email and watch the score update.
7. Use Copy report to keep a plain-text record, Load sample to see worked examples, and Clear to start again.

How the risk score is calculated

Each category accumulates penalty points, and each category has a cap so one repeated problem cannot dominate the result. The four capped category scores are added together and clamped to 100. The score is not a probability and not a spam-filter score; it is the sum of the checks described below.

Category	Maximum points	What adds points
Links	45	Link count, unique domains, shorteners, IP hosts, plain HTTP, punycode, embedded credentials, repeated URLs and link density
Formatting	30	ALL-CAPS words, the share of uppercased words, runs of exclamation marks and an all-caps subject line
Attachments	35	Executable, macro-enabled and archive extensions, double extensions, missing extensions and attachment count
Content	15	Unresolved placeholders and leftover bracket tokens

The score maps to four status bands. Colour is never the only signal: the word is always displayed next to the number.

Score	Status	What it means
0–14	Low risk	The cumulative score is low. Correct any item tagged Fix before sending.
15–34	Guarded	A few minor signals. Work through the items marked Fix and Watch.
35–59	Elevated	Several risk signals. Work through the Fix and Watch items, then re-scan.
60–100	High risk	Strong, repeated signals. Work through the Fix and Watch items before sending to a real list.

Link checks

Links are found as visible URLs beginning with http://, https:// or www. Each URL is parsed for its host and scheme, then checked against these rules:

• Link count: 0–2 links add nothing, 3–4 add 6 points, 5–7 add 12 and 8 or more add 20.
• Domain spread: more than two unique hosts adds 4 points; more than four adds 8 instead.
• URL shorteners: every occurrence of a known shortener such as bit.ly, tinyurl.com, t.co or ow.ly adds 10 points, capped at 20.
• IP-literal hosts: a link to an address such as http://192.168.10.5/claim adds 12 points each, capped at 24. This is a common phishing pattern.
• Plain HTTP: an explicit http:// link adds 3 points each, capped at 9.
• Punycode: a host containing xn-- adds 8 points each, capped at 16, because punycode can disguise a lookalike domain.
• Embedded credentials: a URL with a username or password before the host adds 15 points each, capped at 30.
• Repetition and density: a URL that appears three or more times adds 4 points (capped at 8), and more than six links per 100 body words adds 6 when the body has at least 30 words.

The link category is capped at 45 points. The scanner counts every occurrence for the score but groups identical URLs in the inventory, so a duplicated footer link is visible without being repeated ten times.

This is a plain-text scan. It does not parse HTML, so it cannot pair anchor text with its destination, follow an image or button link, or notice a mismatch between the visible link text and the real URL. Raw markup pasted into the box can create false positives. It does not open links and cannot judge the reputation of the destination.

Formatting checks

The formatting rules look for the patterns that make an email read as bulk mail at a glance:

• ALL-CAPS words: every fully uppercase word of three or more letters adds 5 points, capped at 20. Words containing digits are skipped, and a short whitelist of common acronyms such as SEO, CRM, PDF, B2B and GDPR is ignored.
• Uppercase share: if more than 20% of the words in the subject plus body are fully uppercase, another 6 points are added. This catches a message that is shouting overall even when no single word stands out.
• Exclamation runs: a run of two or more exclamation marks adds 5 points; three or more separate runs add another 3. Single punctuation is ignored.
• All-caps subject: a subject line with at least six letters, all of them uppercase, adds 6 points.

The formatting category is capped at 30 points. The all-caps check is deliberately literal, so a brand name written in capitals will be flagged even when the brand uses that casing. The acronym whitelist is short and not configurable.

Attachment checks

The attachment field is read as a filename list. Folder paths are stripped, duplicates are ignored, and the extension determines the risk label:

• Executables: .exe, .bat, .cmd, .scr, .vbs, .js, .ps1, .msi, .jar, .hta, .reg, .lnk and similar types add 18 points each.
• Macro-enabled Office files: .docm, .xlsm, .pptm, .dotm, .xltm, .potm and .xlam add 10 points each.
• Archives: .zip, .rar, .7z, .tar, .gz, .iso and similar types add 6 points each, because their contents cannot be inspected inline.
• Double extensions: a name such as invoice.pdf.exe adds 8 points on top of the executable penalty.
• Missing extensions: a filename with no extension adds 2 points each, capped at 6.
• Count: more than three attachments adds 4 points; more than five adds 8.

The attachment category is capped at 35 points. This check never opens a file, so it cannot detect malware, estimate file size, or verify that the attachment is what the name claims. It flags the categories that mail filters and cautious recipients treat as risky.

Content checks

The content category checks the subject and body for one specific and very expensive mistake: sending an email with placeholders still in it.

• Unmatched braces: a {{ or }} that is not part of a well-formed merge tag adds 8 points.
• Bracket tokens: tokens such as [First Name], [Company], [Role] or [Insert ...] are flagged.
• Literal placeholders: phrases such as “lorem ipsum”, “your name here”, “insert here”, “TBD” and “XXX” are flagged.
• Merge tags: well-formed tags such as {{first_name}} are not treated as errors. They are reported as a reminder to confirm they resolve for every recipient.
• Attachment mention: if the subject or body says “attached” but no filenames were entered, a tip appears. It adds no points because the attachment field is optional.

The content category is capped at 15 points. Very long bodies are truncated at 20,000 characters for the scan, and the report says so when that happens.

What the scanner cannot tell you

An honest scope matters more than a big number. This tool checks the message text only. It cannot check or predict:

• Authentication: SPF, DKIM and DMARC alignment, or whether your sending domain is configured correctly.
• Reputation: domain and IP reputation, blocklist status, sending volume, complaint rates or engagement history.
• Inbox placement: whether Gmail, Outlook or a corporate filter will deliver the message to the inbox, the promotions tab or spam.
• Rendering: HTML structure, image-to-text ratio, tracking pixels, CSS support or how the email looks in a specific client.
• HTML markup: anchor text, button and image links, and the relationship between the visible text and the real destination. Paste plain text, not HTML source.
• Destination quality: whether a link points to malware, a parked domain or a legitimate page. The scanner never requests a URL.
• Attachment contents: whether a PDF or archive is safe, how large it is, or whether the file is what its name suggests.

A low score means the cumulative weight of the checked signals is small. It does not mean the email avoided every individual risk, will land in the inbox, or is a substitute for a properly authenticated sending domain and a permission-based list.

Worked examples

These are real outputs from the algorithm on this page, using the built-in sample emails. They are illustrations, not benchmarks from live campaigns.

Sample email	Score and status	What drives it
One calendar link, normal casing, one PDF	0 · Low risk	One link and one safe attachment; no caps or placeholder issues.
Promotional subject, shortener, IP link, executable and macro attachments, placeholder	100 · High risk	Eight links including a shortener and an IP host, plus caps, a double extension and unresolved tokens.
Shortener, shouting, bracketed name and two documents	43 · Elevated	Shortened link, all-caps words, repeated exclamation marks and a placeholder, with safe attachments.

The exact point contributions are visible in the Risk breakdown panel. Adjusting one finding does not always change the total immediately, because some penalties are capped and some points come from thresholds rather than single events.

How to reduce risk before sending

1. Keep the link count low. One to three destinations is a sensible working range for a first cold email; every extra link asks the reader to choose and gives a filter one more thing to inspect.
2. Link to the final domain. Replace shorteners with the real URL. A readable destination is easier to trust and easier for a filter to evaluate.
3. Use HTTPS. An explicit http:// link is a small signal, but it is easy to remove and it avoids a browser warning.
4. Write in sentence case. Reserve capitals for genuine acronyms and keep the subject free of shouting.
5. Send documents, not executables. Use .pdf, .docx or .xlsx. If a file is large or sensitive, host it and link to a permission-controlled page instead.
6. Resolve every placeholder. Search the draft for brackets and braces before sending. A broken merge tag is worse than no personalization.
7. Check the report after editing. The score recalculates as you type, so you can see which changes actually removed points.

Frequently asked questions

Is this a spam score or a deliverability guarantee?

Neither. It is a message-level risk checklist. A spam score is produced by a specific filter using signals this page cannot see, and no client-side tool can guarantee inbox placement. Use the score to remove avoidable problems, not to predict an outcome.

How many links should a cold email contain?

There is no universal rule, but one to three is a common working range: usually a primary call to action and perhaps a proof or profile link. This scanner starts adding link points at three links, not because three is forbidden, but because the risk of distraction and over-promotion rises from there.

Do URL shorteners actually hurt deliverability?

They hide the destination, which makes links harder for recipients to trust and gives filters less context. That is why the scanner treats them as a strong signal. If you need branded links, use your own domain with a clear path rather than a public shortener.

Why was my company name flagged as ALL CAPS?

The all-caps check is literal. It skips words with digits and a short list of common acronyms, but it does not know that your brand is officially written in capitals. In that case, treat the finding as a false positive, or write the name in title case in the email.

Should I avoid attachments in cold email?

Risky attachment types are the main concern. Executables and macro-enabled office files are commonly blocked and are a classic malware vector. A normal PDF or document is less problematic, but a first cold email often works better without any attachment at all. If you do attach a file, keep the count low.

Can I scan an HTML email?

Paste the visible plain text, not the raw HTML. The scanner is not an HTML parser, so tags, attributes and stylesheet text can create false positives, and links hidden in href attributes or behind anchor text will not be seen the way a mail client sees them.

Is my email uploaded anywhere?

No. The tool is HTML, CSS and JavaScript running in your browser. There is no server request, no account, no cookie and no local storage. Nothing you type leaves the page.

Related tools

• Cold email subject line grader — score the subject line on length, spam words and personalization
• Spam word checker — a deeper scan of promotional language before you send
• UTM bulk builder — build consistent campaign URLs so every link points where you intend
• Unsubscribe compliance checker — check the opt-out side of the message
• CAN-SPAM / GDPR email checker — review consent, identity and address requirements
• List hygiene planner — because message quality cannot rescue a poor list

Next step

Cleaning a single email is useful; sending a consistent sequence from a properly configured domain is what changes results. That is what mizanursguide.com helps with. See how we build cold email campaigns that are written to be delivered, not just sent.