Do I need an internet connection?

Not for analyzing mail. All analysis happens on your Mac and message content is never sent anywhere. Only starting the subscription (including the free trial) and checking renewals involve communication with the App Store.

How to Use LinkSentinel — Getting Started and Reading the Verdicts

Installation and the getting-started guide

Download LinkSentinel from the App Store and launch it, and the five-page "Get Started with LinkSentinel" guide opens. Click "Next" at the bottom of each page and you'll be up and running in a few minutes.

1

Download from the App Store and launch

Open the Mac App Store, search for "LinkSentinel" and click "Get" or "Install". Launch LinkSentinel from the Applications folder: its icon appears in the menu bar at the top right of the screen, and the "Get Started with LinkSentinel" guide opens a moment later.

2

Welcome: how to read the verdicts, and "LinkSentinel judges cautiously"

The first page explains the five verdicts and LinkSentinel's cautious policy. Mail from a sender you receive for the first time is marked Needs Review rather than green, even when nothing looks suspicious. If you want a sender to show green, register it yourself in Trusted Senders (Whitelist) or Per-Sender Links (Per-Sender Whitelist). Green is not a guarantee of safety.

3

Subscription: start the free trial

On the "Subscription" page, click "Open Subscription Screen", choose the Yearly or Monthly plan and click "Start Free Trial" (free for 14 days; cancel at least 24 hours before the trial ends and you will not be charged). Mail is checked while your subscription is active. If you subscribe later, you can still click "Next" and set up Mail in the meantime. You can also open the subscription screen from "Subscribe…" in the menu bar icon.

4

Turn On the Extension in Mail

Click "Open Mail", then in Mail's menu bar choose "Mail" → "Settings…" → "Extensions" and check "LinkSentinel". After checking the box, open any message in Mail; the guide then shows "A response from the extension was received" (before you subscribe, it shows "You can confirm this after subscribing.").

5

Notifications and Permissions

Click "Allow Notifications" to receive verdicts as notifications (choose which verdicts notify you in Settings). "Allow Access to Contacts" (optional, recommended) lets people in your Contacts be treated as known senders, so their mail is less likely to be marked Needs Review. The "Optional permissions" — Automation ("Allow Control of Mail") and Full Disk Access — are used by "Actions for the selected message in Mail" in the menu and to show account names in the history's Mailbox filter. You can also grant them later from "Check Setup…" in the menu.

6

Done

On the "You're All Set" page, click "Done". If you finish without checking "Don't show this guide at launch for the next two weeks", the guide appears again at the next launch. You can open it any time from "Get Started with LinkSentinel…" in the menu.

Page 1 of the Get Started with LinkSentinel guide, explaining the five verdicts (Dangerous, Blacklisted, Caution, Needs Review, Links Verified), the "LinkSentinel judges cautiously" policy and how to register senders you want to see as green — Page 1 of the getting-started guide (how to read the verdicts and "LinkSentinel judges cautiously")

Mail Settings, Extensions pane, with LinkSentinel checked — Mail "Settings…" → "Extensions"

The menu bar menu

Click the LinkSentinel icon in the menu bar at the top right of the screen to open this menu.

Status (top line): shows when mail was last judged and how many newly received messages were judged today (analyses of older mail you open are not counted), for example "Last analysis: 3 minutes ago (today 12; Dangerous 1)". If there has been no response yet, it reads "No response from the Mail extension yet. Check Mail's settings"; if mail checking is turned off, "Mail checking is off (change in Settings)".
Subscription: …: your subscription status (such as free trial or subscribed). When you are not subscribed it reads "Subscribe…" and opens the subscription screen. While subscribed, "Manage Subscription…" is also available.
Open Mail / Email Analysis History (⌃⌥D)
Actions for the selected message in Mail: for the message selected in Mail, "Allow Links from This Sender…" (⌃⌥A), "Trust This Sender…" (⌃⌥S) and "Block This Sender…" (⌃⌥X) — the same three actions as the buttons in the detail pane of the Email Analysis History. Before anything changes, a confirmation shows the subject and sender of the target message. Nothing is changed if the message has not been judged yet or no message is selected.
Settings…
Check Setup…: shows the "Status" (Subscription, Mail checking, Extension response, Last analysis) and whether Notifications, Contacts, Automation (optional) and Full Disk Access (optional) are allowed. "Show the Getting Started Guide" opens the guide.
Get Started with LinkSentinel…: opens the getting-started guide again.
How to Use: opens this page.

Note: While you are not subscribed, only "Subscribe…", "Get Started with LinkSentinel…", "How to Use" and "Quit" are available.

Note: If you are subscribed and mail checking is on, but there is still no response from the extension an hour after you finished the guide (with Mail running), an orange "!" appears at the top right of the menu bar icon. Open "Check Setup…" and make sure the extension is turned on in Mail.

Checked automatically as mail arrives

LinkSentinel analyzes each message automatically when it arrives. Messages that have not been analyzed yet are analyzed when you open them. Nothing else to do (while you are subscribed or in the free trial).

What appears where

1

Banner at the top of the message

When you open a message, a banner appears at the top. It reads "verdict → sender domain (the part after @ in the sender's address) → what to do", so you see the conclusion first. Example: "🔴 Dangerous: this mail from example.com shows signs of impersonation or dangerous links. Do not open links or attachments."

A banner at the top of a message classified as Dangerous

2

Email Analysis History

Press ⌃⌥D (or choose "Email Analysis History" in the menu). The list has four columns: "Verdict / Date", "Sender", "Subject" and "Summary". Select a row to see details such as the real link destinations, sender authentication (SPF / DKIM / DMARC) and the reasons for the verdict. The detail pane's "Allow Links from This Sender", "Trust This Sender" and "Block This Sender" buttons add that message's sender to a list (the right-click menu works too).

Note: The Email Analysis History shows the real link destinations, whether the sender domain and link domains match, the sender authentication results and the factors that affected the verdict (the latest 1,000 messages; message bodies are not stored). Detected: URLs and Bitcoin addresses in the message body. To delete all history, choose "Clear All History…" from the "…" (More Actions) button at the right end of the toolbar (you are asked to confirm).

Banner types

Note: Besides first-time senders, "Needs Review" also covers messages whose body could not be analyzed (such as attachment-only messages). Mail from a sender registered in Per-Sender Links (Per-Sender Whitelist) is also softened to "Needs Review" when a Watch Domains (Untrusted Domains) match is the only warning.

Note: "Links Verified" means no suspicious signals were detected. It does not guarantee that the link destinations are safe.

Classifications in detail

Each message's risk is shown in one of five colors, so you can decide at a glance.

🟢 Links Verified A known sender, with nothing suspicious found in sender authentication or link destinations

⚪️ Needs Review Nothing suspicious, but the sender is not in Trusted Senders (Whitelist) or Contacts and is writing for the first time. Please check the sender

🟠 Caution Brand impersonation, failed authentication, links of unclear relevance and the like were found

🔴 Dangerous A displayed URL that differs from the real destination, a sender posing as your own company, a domain that is often abused, and similar signs. Don't open the links

⛔️ Blacklisted A known dangerous domain that matched Blocked Senders (Blacklist)

Note: "Links Verified" means no suspicious signals were detected. It does not guarantee that the link destinations are safe. It may not catch a legitimate site that has been compromised or a brand-new technique. The final decision is yours.

How verdicts are made

To learn in detail how LinkSentinel classifies mail, see the Criteria page.

See the criteria →

Frequently Asked Questions (FAQ)

Yes. While you are subscribed (including the free trial), incoming mail is analyzed automatically (mail you send and drafts are excluded). Analysis runs one message at a time, separately from what you do in Mail, so it does not hold up your normal use of Mail.

Not for analyzing mail. All analysis happens on your Mac; LinkSentinel never visits the links and never sends message content to an external server. Verdicts are the same offline. Only starting the subscription (including the free trial) and checking renewals involve communication with the App Store.

Checks have minimal impact on how fast messages load, and you can keep reading and using Mail while they run in the background.

LinkSentinel detects URLs in HTML and plain-text bodies (both the link destinations and URLs written in the text) and Bitcoin addresses. Because it never visits the links, it does not expand short URLs (if the short URL's domain differs from the sender, it is treated as a link of unclear relevance). The contents of images and attachments are not analyzed.

Select the message in Mail and press ⌃⌥A ("Allow Links from This Sender…", which registers it in Per-Sender Links) or ⌃⌥S ("Trust This Sender…", which adds the sender's domain to Trusted Senders); from then on it is less likely to be flagged. You can also select the row in the Email Analysis History and use the buttons in the detail pane. If you correspond with people in China, Russia or similar countries, set that country to "Normal" under "Country and Region Top-Level Domains" in Settings (this setting covers domain endings such as .cn and .ru). See Settings for details.

You can try it free for 14 days. After that, it is a monthly or yearly auto-renewing subscription. Mail is not analyzed while you are not subscribed. For prices, cancellation, Family Sharing and more, see "Pricing & Subscription" in the FAQ.

Yes. All analysis runs on your Mac. Message content and link information are never sent to an external server (LinkSentinel contacts the App Store only to check your subscription).

Troubleshooting

First open "Check Setup…" from the menu and look at the "Status" card: Subscription, Mail checking, Extension response and Last analysis. The top line of the menu shows the same status.

"Version" at the bottom of the "General" tab in Settings shows the app version and the version of the extension actually running in Mail. If it says "A different version of the extension is running", quit Mail and open it again.

If it says "No response from the Mail extension yet"

1

Check that the extension is turned on in Mail

In Mail's menu bar, choose "Mail" → "Settings…" → "Extensions" and make sure "LinkSentinel" is checked. After checking it, open any message in Mail so that a response is recorded.

2

Restart Mail

Quit Mail completely (Command-Q) and open it again.

3

Restart your Mac

If the steps above do not help, restart your Mac.

If no banner appears or messages are not judged

1

Check that your subscription (or free trial) is active

While you are not subscribed (before starting the free trial, or after it expires), mail is not analyzed and no banner is shown. Open the LinkSentinel menu bar icon and check that it shows something like "Subscription: Free trial" or "Subscription: Subscribed". If it shows "Subscribe…", you can open the subscription screen from there. If you have already subscribed with the same Apple ID, try "Restore Purchases".

2

Check that the menu bar app is running

The menu bar app is needed to check your subscription status and to use settings and shortcuts. If you cannot find the icon, launch LinkSentinel from the Applications folder.

3

Check LinkSentinel's settings

Choose "Settings…" from the menu and make sure "Check incoming mail" and "Display Analysis Banner in Mail" are on in the "General" tab.

4

If the banner says "Analyzing"

If the banner reads "LinkSentinel | Analyzing. The result appears the next time you open this message.", wait a moment, select another message, and then open that message again.

5

Update macOS / Apple Mail

LinkSentinel supports Apple Mail on macOS 15 or later. Make sure macOS and Apple Mail are up to date.

If this does not solve the problem, please reach us through the contact page.

A guide walks you through setup