Validation catalog
What ArbiterQA can check
Every check ArbiterQA can run, grouped by what it protects. The catalog covers email in depth, plus the essentials for webpages. Each one is opinionated, versioned against an open Standard, and returns a verdict with evidence — not a screenshot for you to grade.
61 checks across 5 sets
Cold outreach
9 checksChecks for unsolicited first-touch prospecting — email written to read as one-to-one, where success is a reply rather than a click. The Required checks block, and they are the ones where a defect makes the send worth less than not sending: a leaked merge tag, a dead link, and the two legal requirements senders most often omit on the theory that a personal-looking email is not commercial. It is: CAN-SPAM applies at any volume, with no bulk threshold. The rest report without blocking. Deliberately absent are every check that measures whether an email looks professionally designed — logo, hero image, CTA button. Passing those would make a cold email worse, not better.
No placeholder / merge-tag text
RequiredA leaked {{first_name}} or [COMPANY NAME] tells every recipient the send was a mistake; subject line, preheader and body must contain no unfilled merge tags or placeholder text.
Unsubscribe mechanism present
RequiredMarketing email without a working unsubscribe is a legal exposure and a spam-complaint magnet; the message must offer one — a List-Unsubscribe header or a visible link — and that link must not write the recipient's email address into its URL.
Physical mailing address present
RequiredCommercial email without the sender's physical postal address breaks CAN-SPAM and CASL on every send; the message must carry a real mailing address (an ambiguous match is recorded, never failed).
Links valid, reachable, and correctly redirected
RequiredA dead link in a sent email cannot be recalled — the traffic you paid for lands on an error page; every link must be a well-formed URL that resolves, follows a sane redirect chain and lands on a destination you approve (bot-walled links are reported as unverifiable, never failed).
Subject line within length limit
RecommendedMost inboxes clip a long subject mid-thought; the subject line must stay within your character limit.
Preheader / inbox preview text intentional
RecommendedThe preview snippet beside the subject line is the second thing a reader judges you by; it must be intentional — no "view in browser" boilerplate, no leaked merge tokens, required content within the visible window and nothing in the source that garbles the preview.
Images have usable ALT text
RecommendedWith images blocked, an image without usable alternative text disappears along with whatever it said; every image needs real alt text (or an empty alt when decorative), and an image-only link must keep an accessible name.
Tracking parameters present, well-formed, and preserved
RecommendedBroken tracking makes a campaign invisible in analytics after the money is spent; every link's tracking must be intact — no unresolved merge tags, empty or misspelled UTM values, duplicate parameters, ad-platform click IDs or raw email addresses — and, when you configure tracked domains, the parameters you require must be present and survive redirects.
Email opens fully in Gmail
RequiredGmail cuts off a message whose HTML source runs past roughly 102 KB, hiding the footer, the unsubscribe link and the tracking pixel behind "View entire message"; the HTML body must stay under your byte limit.
Marketing email
17 checksChecks for bulk commercial email sent to a consented list — campaigns, newsletters, promotions, lifecycle and re-engagement sends, where success is a click. The Required checks block, because marketing carries the heaviest regulatory load of any email you send: CAN-SPAM and CASL on opt-out and postal address, the European Accessibility Act on alt text, and Gmail, Yahoo and Microsoft on sender authentication — enforced since May 2026 with permanent rejections rather than throttling. The rest report without blocking. Expect failures. This is a demanding standard and real marketing email frequently does not meet it: 61.9% is missing usable alt text, and roughly a quarter ships no plain-text part at all. We would rather tell you that than pass you.
Unsubscribe mechanism present
RequiredMarketing email without a working unsubscribe is a legal exposure and a spam-complaint magnet; the message must offer one — a List-Unsubscribe header or a visible link — and that link must not write the recipient's email address into its URL.
Physical mailing address present
RequiredCommercial email without the sender's physical postal address breaks CAN-SPAM and CASL on every send; the message must carry a real mailing address (an ambiguous match is recorded, never failed).
Footer complete with required elements
RequiredA footer missing its address or unsubscribe link is a compliance exposure on every send; the footer must carry every element you require (by default, a physical address and an unsubscribe link).
Plain-text alternative part present
RequiredWithout a plain-text part, text-only clients, some accessibility tools and some spam filters see nothing; an HTML email must ship a plain-text alternative the sender wrote.
No placeholder / merge-tag text
RequiredA leaked {{first_name}} or [COMPANY NAME] tells every recipient the send was a mistake; subject line, preheader and body must contain no unfilled merge tags or placeholder text.
Links valid, reachable, and correctly redirected
RequiredA dead link in a sent email cannot be recalled — the traffic you paid for lands on an error page; every link must be a well-formed URL that resolves, follows a sane redirect chain and lands on a destination you approve (bot-walled links are reported as unverifiable, never failed).
CTA button visible and unclipped
RequiredA call-to-action nobody can see is a campaign with no click; at least one button must be visible and fully rendered at every selected viewport.
Layout not broken at any viewport
RequiredA layout that collapses at one width is the version some of your list actually sees; the email must hold its layout at every selected viewport.
Images render and scale correctly
RequiredAn image stretched past its own pixels looks soft or blocky on the high-resolution screens most email is read on; every image must load and be displayed at a size its file can actually fill.
Image sources resolve and are permitted
RequiredA dead image is a broken box in the inbox and an image served from the wrong host is a brand or security exposure; every image source must resolve to a real image over a secure path on a host you allow.
Images have usable ALT text
RequiredWith images blocked, an image without usable alternative text disappears along with whatever it said; every image needs real alt text (or an empty alt when decorative), and an image-only link must keep an accessible name.
Preheader / inbox preview text intentional
RequiredThe preview snippet beside the subject line is the second thing a reader judges you by; it must be intentional — no "view in browser" boilerplate, no leaked merge tokens, required content within the visible window and nothing in the source that garbles the preview.
Subject line within length limit
RecommendedMost inboxes clip a long subject mid-thought; the subject line must stay within your character limit.
Brand logo visible in header
RecommendedA reader who cannot see who sent the email treats it as junk; the brand logo must be present and clearly visible in the header at every selected viewport.
Images unclipped and displayed properly
RecommendedAn image cropped mid-headline or mid-face says something you did not intend; no image may be clipped, cropped or scaled in a way that damages its message in any rendered client.
Tracking parameters present, well-formed, and preserved
RecommendedBroken tracking makes a campaign invisible in analytics after the money is spent; every link's tracking must be intact — no unresolved merge tags, empty or misspelled UTM values, duplicate parameters, ad-platform click IDs or raw email addresses — and, when you configure tracked domains, the parameters you require must be present and survive redirects.
Email opens fully in Gmail
RequiredGmail cuts off a message whose HTML source runs past roughly 102 KB, hiding the footer, the unsubscribe link and the tracking pixel behind "View entire message"; the HTML body must stay under your byte limit.
Operational email
13 checksChecks for email you send about your service itself — outage and maintenance notices, security alerts, terms-of-service and privacy changes, product sunsets, forced migrations. This is the only email you send that nobody can opt out of. It reaches your entire user base, including every person using a screen reader and every Outlook recipient who has never added you to their safe-senders list. So the test these checks apply is not "will this convert" but "will everyone understand it, and will they believe it came from you". The Required checks block. A merge tag that never filled in makes a security notice look like a phishing attempt. A dead link strands someone who has been told to act and given nowhere to go. Images with no alt text hide the instruction from the readers most likely to have images switched off. Everything else reports. ⚠ Run this against a test send. Some of these checks follow the links and images in your email. The risk is far lower here than for transactional mail — we measured tokenised account-action links in 4% of operational email, against 63% of transactional — but 81% carries an open-tracking pixel, so a validation run will register an open you did not earn. Deliberately absent: the unsubscribe link (you cannot opt out of a security notice, and offering one is a control that either does nothing or breaks account management), campaign tracking checks (there is no campaign to attribute a maintenance window to), and the call-to-action assertion (half of operational email correctly has no CTA at all, and not one outage notice we measured carries a button).
No placeholder / merge-tag text
RequiredA leaked {{first_name}} or [COMPANY NAME] tells every recipient the send was a mistake; subject line, preheader and body must contain no unfilled merge tags or placeholder text.
Links valid, reachable, and correctly redirected
RequiredA dead link in a sent email cannot be recalled — the traffic you paid for lands on an error page; every link must be a well-formed URL that resolves, follows a sane redirect chain and lands on a destination you approve (bot-walled links are reported as unverifiable, never failed).
Plain-text alternative part present
RequiredWithout a plain-text part, text-only clients, some accessibility tools and some spam filters see nothing; an HTML email must ship a plain-text alternative the sender wrote.
Images have usable ALT text
RequiredWith images blocked, an image without usable alternative text disappears along with whatever it said; every image needs real alt text (or an empty alt when decorative), and an image-only link must keep an accessible name.
Images render and scale correctly
RequiredAn image stretched past its own pixels looks soft or blocky on the high-resolution screens most email is read on; every image must load and be displayed at a size its file can actually fill.
Image sources resolve and are permitted
RequiredA dead image is a broken box in the inbox and an image served from the wrong host is a brand or security exposure; every image source must resolve to a real image over a secure path on a host you allow.
Layout not broken at any viewport
RecommendedA layout that collapses at one width is the version some of your list actually sees; the email must hold its layout at every selected viewport.
Images unclipped and displayed properly
RecommendedAn image cropped mid-headline or mid-face says something you did not intend; no image may be clipped, cropped or scaled in a way that damages its message in any rendered client.
Subject line within length limit
RecommendedMost inboxes clip a long subject mid-thought; the subject line must stay within your character limit.
Preheader / inbox preview text intentional
RecommendedThe preview snippet beside the subject line is the second thing a reader judges you by; it must be intentional — no "view in browser" boilerplate, no leaked merge tokens, required content within the visible window and nothing in the source that garbles the preview.
Physical mailing address present
RecommendedCommercial email without the sender's physical postal address breaks CAN-SPAM and CASL on every send; the message must carry a real mailing address (an ambiguous match is recorded, never failed).
Brand logo visible in header
RecommendedA reader who cannot see who sent the email treats it as junk; the brand logo must be present and clearly visible in the header at every selected viewport.
Email opens fully in Gmail
RequiredGmail cuts off a message whose HTML source runs past roughly 102 KB, hiding the footer, the unsubscribe link and the tracking pixel behind "View entire message"; the HTML body must stay under your byte limit.
Transactional email
13 checksChecks for email triggered by your customer's own action and carrying data they are waiting for — receipts, order and shipping confirmations, password resets, verification codes, invoices. The Required checks block. The test we apply is not "is this untidy" but "does the recipient end up unable to do the thing they came to do": a merge tag that never filled in, a dead reset link, a verification code with no plain-text version, images with no alt text in an inbox that blocks images. Everything else reports. ⚠ Run this against a test send, not a live one. Some of these checks follow the links and images in your email, and in transactional mail those links do things — they confirm addresses, sign people in, authenticate order access. Validating a real message addressed to a real person can consume a one-time token or register activity in your own systems. Deliberately absent: the unsubscribe link (you cannot opt out of the mail that runs your account), campaign tracking checks (there is no campaign to attribute a receipt to), and the call-to-action assertion (half of transactional senders correctly have no CTA at all).
No placeholder / merge-tag text
RequiredA leaked {{first_name}} or [COMPANY NAME] tells every recipient the send was a mistake; subject line, preheader and body must contain no unfilled merge tags or placeholder text.
Links valid, reachable, and correctly redirected
RequiredA dead link in a sent email cannot be recalled — the traffic you paid for lands on an error page; every link must be a well-formed URL that resolves, follows a sane redirect chain and lands on a destination you approve (bot-walled links are reported as unverifiable, never failed).
Plain-text alternative part present
RequiredWithout a plain-text part, text-only clients, some accessibility tools and some spam filters see nothing; an HTML email must ship a plain-text alternative the sender wrote.
Images have usable ALT text
RequiredWith images blocked, an image without usable alternative text disappears along with whatever it said; every image needs real alt text (or an empty alt when decorative), and an image-only link must keep an accessible name.
Images render and scale correctly
RequiredAn image stretched past its own pixels looks soft or blocky on the high-resolution screens most email is read on; every image must load and be displayed at a size its file can actually fill.
Image sources resolve and are permitted
RequiredA dead image is a broken box in the inbox and an image served from the wrong host is a brand or security exposure; every image source must resolve to a real image over a secure path on a host you allow.
Layout not broken at any viewport
RecommendedA layout that collapses at one width is the version some of your list actually sees; the email must hold its layout at every selected viewport.
Images unclipped and displayed properly
RecommendedAn image cropped mid-headline or mid-face says something you did not intend; no image may be clipped, cropped or scaled in a way that damages its message in any rendered client.
Subject line within length limit
RecommendedMost inboxes clip a long subject mid-thought; the subject line must stay within your character limit.
Preheader / inbox preview text intentional
RecommendedThe preview snippet beside the subject line is the second thing a reader judges you by; it must be intentional — no "view in browser" boilerplate, no leaked merge tokens, required content within the visible window and nothing in the source that garbles the preview.
Physical mailing address present
RecommendedCommercial email without the sender's physical postal address breaks CAN-SPAM and CASL on every send; the message must carry a real mailing address (an ambiguous match is recorded, never failed).
Brand logo visible in header
RecommendedA reader who cannot see who sent the email treats it as junk; the brand logo must be present and clearly visible in the header at every selected viewport.
Email opens fully in Gmail
RequiredGmail cuts off a message whose HTML source runs past roughly 102 KB, hiding the footer, the unsubscribe link and the tracking pixel behind "View entire message"; the HTML body must stay under your byte limit.
More email checks
9 checksAdditional listed checks for email subjects.
Accessibility criteria met (WCAG, source-decidable)
RecommendedAn email a screen reader cannot navigate or a low-vision reader cannot make out is a message part of your list never receives; this checks the accessibility defects decidable from the source — language, table semantics, colour contrast, link names, tap targets, animation — and abstains rather than guesses on the rest.
AI summary matches the email
RecommendedGmail writes its own AI summary above your message and a growing share of recipients read that instead of the email; the summary must carry the action you are asking for, the deadline you set and the sender you are, and must not state anything your email does not say.
From-domain match
RecommendedMail sent from a domain you do not own reads as spoofing to filters and recipients alike; the From address must belong to one of your approved sender domains.
Hero / banner image renders
RecommendedA hero that fails to load leaves the reader a blank box where the offer should be; the primary banner image must load and render fully.
Subject line matches approved content
RecommendedA subject line that drifts from what was approved is the most visible mistake a send can make; the received subject must match your approved subjects, contain the phrases you require and avoid the patterns you prohibit (skipped until you configure it).
Typography follows approved brand rules
RecommendedAn off-brand font stack is the fastest way an email stops looking like it came from you; every font stack must match an approved brand stack, webfonts must carry an Outlook fallback, and weights and sizes must use vocabulary mail clients honour (skipped until you configure it).
Link UTM and query parameters inventoried
RecommendedKnowing exactly which tracking parameters each link carries is how you spot the one campaign that will not attribute; this lists every link's query parameters with the UTM keys called out, and always passes — it reports, it does not judge.
UTM tags follow the SchemaFirst UTM Standard
RecommendedWhen two people tag the same campaign differently, one campaign reports as several and nobody can say what it earned; every tagged link must follow the SchemaFirst UTM Standard — source, medium and campaign all present, the campaign a lowercase underscore slug that does not repeat the source or channel, and every value lowercase with no spaces — on top of the tracking integrity rules for merge tags, click IDs, personal data and dropped parameters.
Email still legible with images off
RecommendedOutlook shows images blocked to every recipient who has not added you to Safe Senders; the email must still convey its offer and give the reader a way to act with images off (requires the alt-text validation, which covers the other half of the same question).
Webpages
17 checks across 6 sets
Accessibility
1 checkBody text stays in a readable size range on the page.
Brand
2 checksLogo and footer present as the brand requires.
Logo Usage
RequiredA missing or mistreated logo undermines every other brand signal on the page; the logo must be present and follow your brand guidelines.
Footer Compliance
RequiredA footer missing a required element is a compliance gap on every page; the page footer must include the brand elements you require.
Change detection
1 checkThe page is compared to the last capture of the same URL and width.
Content
1 checkPlaceholder copy such as lorem ipsum is not on the page.
Performance
1 checkLoad time is measured from the browser clock.
More webpage checks
11 checksAdditional listed checks for webpage subjects.
Images have a text alternative
RequiredA screen reader announces an image with no text alternative as a file name or not at all, so whatever it showed is lost; every meaningful image must carry alternative text and every decorative one must be marked as such.
Motion stops when the reader asks
RecommendedEndless carousels, looping backgrounds and spinning graphics make some readers dizzy or ill and pull everyone’s eye away from the words; motion lasting more than five seconds must stop when the reader’s device asks for reduced motion.
Keyboard focus is visible
RequiredA keyboard user who cannot see where focus is cannot tell which link Enter will follow; every element must show a visible change when it receives keyboard focus.
Form fields are labelled
RequiredA screen reader announces an unlabelled field as just "edit text", so the visitor cannot tell what to type and abandons the form; every input, select and toggle must carry a programmatic label.
Everything works from the keyboard
RequiredPeople who cannot use a mouse — and every screen-reader user — move through a page with the keyboard; a control it cannot reach or a spot it cannot leave stops them dead, so every control must be reachable with Tab and focus must never get stuck.
Page declares its language
RequiredWithout a declared language a screen reader reads the page in the listener’s own language and mispronounces every word; the page and any passage in another language must say which language they are in.
Links say where they go
RequiredA screen-reader user skimming a list of links hears "link" or a row of identical "learn more"s and cannot tell them apart; every link must have a name, and a generic one needs the words around it to say where it goes.
Form fields stand out from the page
RecommendedA text box whose outline is a faint grey on white is invisible to people with low vision, who cannot find where to type; the border or fill that shows where a field is must reach a 3:1 contrast with what surrounds it.
Tap targets are large enough
RecommendedA link or button too small to hit gets mis-tapped by anyone with a tremor and by most people on a phone; every target must be at least 24 by 24 pixels or have that much clear space around it.
Text has enough contrast
RequiredText too close in colour to its background is unreadable for people with low vision and for everyone in bright light; normal text must reach a 4.5:1 contrast ratio and large text 3:1.
Videos have captions
RequiredA video with no captions says nothing to a viewer who is deaf, hard of hearing, or watching with the sound off; every video with sound must offer synchronised captions.
Common questions
- What is a Validation?
- A Validation is a single opinionated check — visual or functional — that ArbiterQA runs against an email or webpage and returns as pass, fail, or error with evidence attached.
- What is a Validation Set?
- A Validation Set is a curated group of checks that protect one outcome, such as brand compliance or accessibility. Selecting a set runs every check it contains.
- Can I customize what a check enforces?
- Checks with custom configuration let you replace the Standard default with your own rule — your logo requirement, your footer elements — while keeping the same judgment engine.
- How do I run these?
- Name the checks or sets through the API, MCP, or the ArbiterQA CLI (@rbtrqa/cli). ArbiterQA renders the subject, runs the checks, and returns a structured verdict your CI or agent can gate on.
Point ArbiterQA at your first check
Agents call the same catalog you see here through the API, MCP, or the ArbiterQA CLI (@rbtrqa/cli). Start free with 1,000 credits.