What does a link scanner check in an email?
A link scanner lists every address an email's HTML points to: the links with their visible text, the hosts its images load from, and the tracking pixels, usually 1×1 or hidden images. Many filters look up linked domains in blocklists and score some link patterns, such as text naming one site while the link goes to another.
Reading the result
Paste the HTML. You get every link with its text and address, flagged where the text names a different domain, or the link uses a URL shortener, plain http, a bare IP address or javascript:. Then every image, with likely pixels marked, every host and the count of distinct domains. Nothing is fetched or followed, and nothing leaves your browser.
Common problems it finds
Link text that names another site
Text reading https://www.example.com on a link that goes elsewhere is the shape of phishing, and SpamAssassin scores one form of it (HTTPS_HTTP_MISMATCH). Click tracking produces the same shape, so write link text in words rather than addresses.
URL shorteners
A shortener domain is shared by everyone who uses it, spammers included, and it hides where the link leads. SpamAssassin keeps a list of them for its rules. Link to your own domain.
Links to an IP address
SpamAssassin scores links to a bare IPv4 address (NUMERIC_HTTP_ADDR, NORMAL_HTTP_TO_IP). Give the server a hostname.
Many different domains
Each domain a message links to or loads from is one more reputation it depends on, and one more that could be on a blocklist. Tracking, images, fonts and social icons each tend to add one.