Some Background
- We have an app which requires users registration
- When a user registers, we send a confirmation email
- The email contains a Firebase Dynamic Link to a web page and is caught by the app if it's installed
- Since the final link contains a unique confirmation token, we generate a dynamic link each time using the Firebase dynamic link REST API
- The generated dynamic link is something like this: https://{domain}.app.goo.gl/{randomChars}
- The final link points to our domain, which is using HTTPS
The Problem
- When I try to open that link in Gmail (both desktop and android), a pop-up appears that says:
Suspicious link
This link has been flagged as suspicious. Are you sure you want to proceed to {domain}.app.goo.gl?
Notes
- It's weird that the top-level domain is from Google, and it's flagged as suspicious
- The email contains other links, e.g. to the home page, youtube, instagram and facebook, and those open without any issue (all of them are HTTPS)
- We're using Rackspace/Mailgun to send emails
Any insights will be really useful.
Edit:
I checked both domains ({domain}.app.goo.gl and ours) in MX Toolbox and no blacklist was found.