Linktarythe notary for links

Why your corporate network blocks URL shorteners (and what allowlist-grade means)

2026-09-25 · 7 min read · Linktary team

Why your corporate network blocks URL shorteners (and what allowlist-grade means)

If you run IT for a company of any size, you've blocked URL shorteners. Probably all of them, by category, at the proxy. This article explains why that block exists, why it's correct, and what a shortener would have to look like for you to let it back in.

The problem: an opaque redirect

A short link is an opaque redirect. The user sees short.ly/abc123; the destination is hidden until the click happens. That opacity is exactly the property attackers need:

Generic shorteners make all three worse because they're open: anyone can shorten anything, the redirect is immediate, and there's no record of what the link actually points to. From the network's perspective, a shortener domain is a hole in the visibility wall. Blocking it is the rational move.

The enterprise answer: allowlists

Enterprises don't respond to untrusted infrastructure with hope. They respond with allowlists: explicit enumerations of what's permitted, with everything else denied by default. For a shortener to earn a place on an allowlist, the IT team needs a reason to trust it — not a marketing page, but structural properties they can verify independently.

Here's what "allowlist-grade" concretely means. It's four properties, and all four have to hold:

  1. One clean domain. Short paths live on a single, reputable

    2. top-level domain — in our case, linktary.com itself. No redirect chains through third-party short domains, no alphabet soup of vanity subdomains. One allowlist entry covers everything the service does, and the entry is trivially reviewable.

  2. Transparent verification. Every destination is checked before the

    3. link works — not after a click, not on complaint. The verification machinery is published: what signals, what weights, what thresholds. (Ours is documented in How Linktary verifies a link.)

  3. Public trust reports. Every link carries an auditable record: the

    4. verdict, the redirect chain, the certificate information, and the timestamp of the check. Your security team can inspect any link without an account and without asking us. A shortener whose links can't be independently audited is asking you to trust the vendor's word; we ask you to trust the report.

  4. Authenticated creation only. Open shorteners are phishing magnets

    5. because anyone can mint a link. Requiring a verified account to create links — ours uses email magic links, no passwords to phish — raises the cost of abuse and gives the vendor a lever against abusers: the account. Combined with per-account creation limits, per-IP redirect limits, a public abuse-report path, and an admin blocklist, this is the abuse moat that keeps the domain's reputation clean over time.

The test you can run in five minutes

If you're evaluating whether a shortener deserves an allowlist entry, don't read its marketing. Do this instead:

  1. Shorten a URL you control. Open the link's trust report. Does it show

    2. the real destination, the chain, and the check time?

  2. Shorten something hostile — a redirect loop, an executable, a fresh

    3. punycode domain. Does the verdict change? Does the report explain why?

  3. Ask the vendor what they can see about your links' visitors. (If they

    4. keep per-visitor access logs with IPs and referrers, that's a privacy posture you should know about before allowlisting.)

A vendor that answers all three with evidence is allowlist-grade. A vendor that answers with a brochure is not.

Linktary was built to pass this test on day one. If you own a blocklist and want the one-page version for your ticket system, the allowlist page has the exact domain to allow, why it's safe, and a copy-paste justification paragraph.

Further reading