When a phishing email presents a link, they often send you to a webpage that redirects you to another webpage that they harvest your data from. Does the Quick Look feature in Mail follow these redirects?

If it doesn't, can I assume that this is a safe way to do an initial quick check that a link is from a nefarious source?

i.e Would I expect to see the Redirecting... message in the Quick Look window? Would the people who created the exploit get any indication that I "clicked" on the link?

  • True redirects, as opposed to ones faked up with HTML, never display any page, “Redirecting…” or otherwise, so you can't use that as an indication. It would be very, very surprising if this Quick Look didn't follow them, but I don't actually know.
    – Kevin Reid
    Commented Feb 11, 2012 at 12:56

1 Answer 1


The simple answer is no, QuickLook will not follow links.

The more complex answer is as follows and excuse the exposition and some of the generalisations, it's a bit of a minefield is email.

If you think of QuickLook in general, applications provide an interface to their core logic to allow QuickLook to provide its functionality to the user, i.e. preview of different files types.

QuickLook on emails within Mail.app may differ to what is seen within Entourage or Outlook simply because the email is stored within the data storage of those applications, and QuickLook will use the registered app for that type to provide the preview functionality.

So in general, it is the registered email application doing the work of providing the preview.

Email applications regularly provide a certain level of protection for rich text and HTML formatted emails (unless you were using Outlook Express in the last 10 years haha) as follows:

  • Image preview turned off for unknown senders/email marked spam (sometimes a configurable option)
  • Non-execution of Javascript
  • Non-execution of Flash (Mail.app - bad, bad app allows this)
  • Non-rendering of embedded images/files
  • Detection of obfuscated content

Links within the email are part of the text content of the email, spam filters may validate the link URL against the domain the email was sent from but will never crawl the link to determine the links validity.

Any links that are not pure HTML anchors and are Javascript based will not be executed and therefore not followed either.

Some corporate email gateways will crawl standard links to determine link validity which cause some major nightmares for those people whose business is to track valid commercially sent emails, but the process they use just records the HTTP response from the link URL rather than the HTTP content of the response.

So as you can see from the above, the answer is categorically no, QuickLook will never follow the links in a previewed email, as long the the QuickLook provider for the email provides the minimum amount of security for reading emails.

Just for context, I worked for 3 years for an ESP (Email Service Provider), one of those companies that send emails on the behalf of major corporations and retailers.

A lot of the time, marketing departments would ask these same questions and ask us how to work round them. Naughty naughty people that they were :p

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .