I understand your concerns I personally hate short generic links. They are a big security risk especially phishing ones.

The way I counter this is by not allowing people people to create generic links in the first place unless you are a paid customer. Plus, you need to add your custom domain to do something meaningful on the platform.

That pretty much weeds out 100% of scammers.

Can you elaborate more on this? I think we are getting blocked :|

A link shortener is a simple way for malicious or spammy email senders to cloak their malicious or spammy link in something which is not yet on a block list.

So what we find is that as new ones come into the market they are eagerly adopted and we start to see evil links. From our point of view the earlier we put in place a wholesale block the better, because otherwise they may become "too big to block" like bit.ly etc... Although even these are blocked by gmail from time to time (for example).

If security software can read email enough to observe the shortened URL, couldn’t it just see what it expands to and then judge the target URL? Link shorteners don’t seem to have any obvious CAPTCHAs.

We have about 500ms to make our assessment so we wouldn't follow a link in realtime and depend on it resolving and redirecting etc.

Instead we expand them later and visit and scan them after the fact. But at that point the email is often already delivered.

But bottom line url shorteners are so abused as to be a de facto sign of spam.