Validation catalog

What ArbiterQA can check

Every check ArbiterQA can run, grouped by what it protects. The catalog covers email in depth, plus the essentials for webpages. Each one is opinionated, versioned against an open Standard, and returns a verdict with evidence — not a screenshot for you to grade.

Email

61 checks across 5 sets

Cold outreach

9 checks

Checks for unsolicited first-touch prospecting — email written to read as one-to-one, where success is a reply rather than a click. The Required checks block, and they are the ones where a defect makes the send worth less than not sending: a leaked merge tag, a dead link, and the two legal requirements senders most often omit on the theory that a personal-looking email is not commercial. It is: CAN-SPAM applies at any volume, with no bulk threshold. The rest report without blocking. Deliberately absent are every check that measures whether an email looks professionally designed — logo, hero image, CTA button. Passing those would make a cold email worse, not better.

No placeholder / merge-tag text

Required

A leaked {{first_name}} or [COMPANY NAME] tells every recipient the send was a mistake; subject line, preheader and body must contain no unfilled merge tags or placeholder text.

Unsubscribe mechanism present

Required

Marketing email without a working unsubscribe is a legal exposure and a spam-complaint magnet; the message must offer one — a List-Unsubscribe header or a visible link — and that link must not write the recipient's email address into its URL.

Physical mailing address present

Required

Commercial email without the sender's physical postal address breaks CAN-SPAM and CASL on every send; the message must carry a real mailing address (an ambiguous match is recorded, never failed).

Links valid, reachable, and correctly redirected

Required

A dead link in a sent email cannot be recalled — the traffic you paid for lands on an error page; every link must be a well-formed URL that resolves, follows a sane redirect chain and lands on a destination you approve (bot-walled links are reported as unverifiable, never failed).

Subject line within length limit

Recommended

Most inboxes clip a long subject mid-thought; the subject line must stay within your character limit.

Preheader / inbox preview text intentional

Recommended

The preview snippet beside the subject line is the second thing a reader judges you by; it must be intentional — no "view in browser" boilerplate, no leaked merge tokens, required content within the visible window and nothing in the source that garbles the preview.

Images have usable ALT text

Recommended

With images blocked, an image without usable alternative text disappears along with whatever it said; every image needs real alt text (or an empty alt when decorative), and an image-only link must keep an accessible name.

Tracking parameters present, well-formed, and preserved

Recommended

Broken tracking makes a campaign invisible in analytics after the money is spent; every link's tracking must be intact — no unresolved merge tags, empty or misspelled UTM values, duplicate parameters, ad-platform click IDs or raw email addresses — and, when you configure tracked domains, the parameters you require must be present and survive redirects.

Email opens fully in Gmail

Required

Gmail cuts off a message whose HTML source runs past roughly 102 KB, hiding the footer, the unsubscribe link and the tracking pixel behind "View entire message"; the HTML body must stay under your byte limit.

Marketing email

17 checks

Checks for bulk commercial email sent to a consented list — campaigns, newsletters, promotions, lifecycle and re-engagement sends, where success is a click. The Required checks block, because marketing carries the heaviest regulatory load of any email you send: CAN-SPAM and CASL on opt-out and postal address, the European Accessibility Act on alt text, and Gmail, Yahoo and Microsoft on sender authentication — enforced since May 2026 with permanent rejections rather than throttling. The rest report without blocking. Expect failures. This is a demanding standard and real marketing email frequently does not meet it: 61.9% is missing usable alt text, and roughly a quarter ships no plain-text part at all. We would rather tell you that than pass you.

Unsubscribe mechanism present

Required

Marketing email without a working unsubscribe is a legal exposure and a spam-complaint magnet; the message must offer one — a List-Unsubscribe header or a visible link — and that link must not write the recipient's email address into its URL.

Physical mailing address present

Required

Commercial email without the sender's physical postal address breaks CAN-SPAM and CASL on every send; the message must carry a real mailing address (an ambiguous match is recorded, never failed).

Footer complete with required elements

Required

A footer missing its address or unsubscribe link is a compliance exposure on every send; the footer must carry every element you require (by default, a physical address and an unsubscribe link).

Plain-text alternative part present

Required

Without a plain-text part, text-only clients, some accessibility tools and some spam filters see nothing; an HTML email must ship a plain-text alternative the sender wrote.

No placeholder / merge-tag text

Required

A leaked {{first_name}} or [COMPANY NAME] tells every recipient the send was a mistake; subject line, preheader and body must contain no unfilled merge tags or placeholder text.

Links valid, reachable, and correctly redirected

Required

A dead link in a sent email cannot be recalled — the traffic you paid for lands on an error page; every link must be a well-formed URL that resolves, follows a sane redirect chain and lands on a destination you approve (bot-walled links are reported as unverifiable, never failed).

CTA button visible and unclipped

Required

A call-to-action nobody can see is a campaign with no click; at least one button must be visible and fully rendered at every selected viewport.

Layout not broken at any viewport

Required

A layout that collapses at one width is the version some of your list actually sees; the email must hold its layout at every selected viewport.

Images render and scale correctly

Required

An image stretched past its own pixels looks soft or blocky on the high-resolution screens most email is read on; every image must load and be displayed at a size its file can actually fill.

Image sources resolve and are permitted

Required

A dead image is a broken box in the inbox and an image served from the wrong host is a brand or security exposure; every image source must resolve to a real image over a secure path on a host you allow.

Images have usable ALT text

Required

With images blocked, an image without usable alternative text disappears along with whatever it said; every image needs real alt text (or an empty alt when decorative), and an image-only link must keep an accessible name.

Preheader / inbox preview text intentional

Required

The preview snippet beside the subject line is the second thing a reader judges you by; it must be intentional — no "view in browser" boilerplate, no leaked merge tokens, required content within the visible window and nothing in the source that garbles the preview.

Subject line within length limit

Recommended

Most inboxes clip a long subject mid-thought; the subject line must stay within your character limit.

Brand logo visible in header

Recommended

A reader who cannot see who sent the email treats it as junk; the brand logo must be present and clearly visible in the header at every selected viewport.

Images unclipped and displayed properly

Recommended

An image cropped mid-headline or mid-face says something you did not intend; no image may be clipped, cropped or scaled in a way that damages its message in any rendered client.

Tracking parameters present, well-formed, and preserved

Recommended

Broken tracking makes a campaign invisible in analytics after the money is spent; every link's tracking must be intact — no unresolved merge tags, empty or misspelled UTM values, duplicate parameters, ad-platform click IDs or raw email addresses — and, when you configure tracked domains, the parameters you require must be present and survive redirects.

Email opens fully in Gmail

Required

Gmail cuts off a message whose HTML source runs past roughly 102 KB, hiding the footer, the unsubscribe link and the tracking pixel behind "View entire message"; the HTML body must stay under your byte limit.

Operational email

13 checks

Checks for email you send about your service itself — outage and maintenance notices, security alerts, terms-of-service and privacy changes, product sunsets, forced migrations. This is the only email you send that nobody can opt out of. It reaches your entire user base, including every person using a screen reader and every Outlook recipient who has never added you to their safe-senders list. So the test these checks apply is not "will this convert" but "will everyone understand it, and will they believe it came from you". The Required checks block. A merge tag that never filled in makes a security notice look like a phishing attempt. A dead link strands someone who has been told to act and given nowhere to go. Images with no alt text hide the instruction from the readers most likely to have images switched off. Everything else reports. ⚠ Run this against a test send. Some of these checks follow the links and images in your email. The risk is far lower here than for transactional mail — we measured tokenised account-action links in 4% of operational email, against 63% of transactional — but 81% carries an open-tracking pixel, so a validation run will register an open you did not earn. Deliberately absent: the unsubscribe link (you cannot opt out of a security notice, and offering one is a control that either does nothing or breaks account management), campaign tracking checks (there is no campaign to attribute a maintenance window to), and the call-to-action assertion (half of operational email correctly has no CTA at all, and not one outage notice we measured carries a button).

No placeholder / merge-tag text

Required

A leaked {{first_name}} or [COMPANY NAME] tells every recipient the send was a mistake; subject line, preheader and body must contain no unfilled merge tags or placeholder text.

Links valid, reachable, and correctly redirected

Required

A dead link in a sent email cannot be recalled — the traffic you paid for lands on an error page; every link must be a well-formed URL that resolves, follows a sane redirect chain and lands on a destination you approve (bot-walled links are reported as unverifiable, never failed).

Plain-text alternative part present

Required

Without a plain-text part, text-only clients, some accessibility tools and some spam filters see nothing; an HTML email must ship a plain-text alternative the sender wrote.

Images have usable ALT text

Required

With images blocked, an image without usable alternative text disappears along with whatever it said; every image needs real alt text (or an empty alt when decorative), and an image-only link must keep an accessible name.

Images render and scale correctly

Required

An image stretched past its own pixels looks soft or blocky on the high-resolution screens most email is read on; every image must load and be displayed at a size its file can actually fill.

Image sources resolve and are permitted

Required

A dead image is a broken box in the inbox and an image served from the wrong host is a brand or security exposure; every image source must resolve to a real image over a secure path on a host you allow.

Layout not broken at any viewport

Recommended

A layout that collapses at one width is the version some of your list actually sees; the email must hold its layout at every selected viewport.

Images unclipped and displayed properly

Recommended

An image cropped mid-headline or mid-face says something you did not intend; no image may be clipped, cropped or scaled in a way that damages its message in any rendered client.

Subject line within length limit

Recommended

Most inboxes clip a long subject mid-thought; the subject line must stay within your character limit.

Preheader / inbox preview text intentional

Recommended

The preview snippet beside the subject line is the second thing a reader judges you by; it must be intentional — no "view in browser" boilerplate, no leaked merge tokens, required content within the visible window and nothing in the source that garbles the preview.

Physical mailing address present

Recommended

Commercial email without the sender's physical postal address breaks CAN-SPAM and CASL on every send; the message must carry a real mailing address (an ambiguous match is recorded, never failed).

Brand logo visible in header

Recommended

A reader who cannot see who sent the email treats it as junk; the brand logo must be present and clearly visible in the header at every selected viewport.

Email opens fully in Gmail

Required

Gmail cuts off a message whose HTML source runs past roughly 102 KB, hiding the footer, the unsubscribe link and the tracking pixel behind "View entire message"; the HTML body must stay under your byte limit.

Transactional email

13 checks

Checks for email triggered by your customer's own action and carrying data they are waiting for — receipts, order and shipping confirmations, password resets, verification codes, invoices. The Required checks block. The test we apply is not "is this untidy" but "does the recipient end up unable to do the thing they came to do": a merge tag that never filled in, a dead reset link, a verification code with no plain-text version, images with no alt text in an inbox that blocks images. Everything else reports. ⚠ Run this against a test send, not a live one. Some of these checks follow the links and images in your email, and in transactional mail those links do things — they confirm addresses, sign people in, authenticate order access. Validating a real message addressed to a real person can consume a one-time token or register activity in your own systems. Deliberately absent: the unsubscribe link (you cannot opt out of the mail that runs your account), campaign tracking checks (there is no campaign to attribute a receipt to), and the call-to-action assertion (half of transactional senders correctly have no CTA at all).

No placeholder / merge-tag text

Required

A leaked {{first_name}} or [COMPANY NAME] tells every recipient the send was a mistake; subject line, preheader and body must contain no unfilled merge tags or placeholder text.

Links valid, reachable, and correctly redirected

Required

A dead link in a sent email cannot be recalled — the traffic you paid for lands on an error page; every link must be a well-formed URL that resolves, follows a sane redirect chain and lands on a destination you approve (bot-walled links are reported as unverifiable, never failed).

Plain-text alternative part present

Required

Without a plain-text part, text-only clients, some accessibility tools and some spam filters see nothing; an HTML email must ship a plain-text alternative the sender wrote.

Images have usable ALT text

Required

With images blocked, an image without usable alternative text disappears along with whatever it said; every image needs real alt text (or an empty alt when decorative), and an image-only link must keep an accessible name.

Images render and scale correctly

Required

An image stretched past its own pixels looks soft or blocky on the high-resolution screens most email is read on; every image must load and be displayed at a size its file can actually fill.

Image sources resolve and are permitted

Required

A dead image is a broken box in the inbox and an image served from the wrong host is a brand or security exposure; every image source must resolve to a real image over a secure path on a host you allow.

Layout not broken at any viewport

Recommended

A layout that collapses at one width is the version some of your list actually sees; the email must hold its layout at every selected viewport.

Images unclipped and displayed properly

Recommended

An image cropped mid-headline or mid-face says something you did not intend; no image may be clipped, cropped or scaled in a way that damages its message in any rendered client.

Subject line within length limit

Recommended

Most inboxes clip a long subject mid-thought; the subject line must stay within your character limit.

Preheader / inbox preview text intentional

Recommended

The preview snippet beside the subject line is the second thing a reader judges you by; it must be intentional — no "view in browser" boilerplate, no leaked merge tokens, required content within the visible window and nothing in the source that garbles the preview.

Physical mailing address present

Recommended

Commercial email without the sender's physical postal address breaks CAN-SPAM and CASL on every send; the message must carry a real mailing address (an ambiguous match is recorded, never failed).

Brand logo visible in header

Recommended

A reader who cannot see who sent the email treats it as junk; the brand logo must be present and clearly visible in the header at every selected viewport.

Email opens fully in Gmail

Required

Gmail cuts off a message whose HTML source runs past roughly 102 KB, hiding the footer, the unsubscribe link and the tracking pixel behind "View entire message"; the HTML body must stay under your byte limit.

More email checks

9 checks

Additional listed checks for email subjects.

Accessibility criteria met (WCAG, source-decidable)

Recommended

An email a screen reader cannot navigate or a low-vision reader cannot make out is a message part of your list never receives; this checks the accessibility defects decidable from the source — language, table semantics, colour contrast, link names, tap targets, animation — and abstains rather than guesses on the rest.

AI summary matches the email

Recommended

Gmail writes its own AI summary above your message and a growing share of recipients read that instead of the email; the summary must carry the action you are asking for, the deadline you set and the sender you are, and must not state anything your email does not say.

From-domain match

Recommended

Mail sent from a domain you do not own reads as spoofing to filters and recipients alike; the From address must belong to one of your approved sender domains.

Hero / banner image renders

Recommended

A hero that fails to load leaves the reader a blank box where the offer should be; the primary banner image must load and render fully.

Subject line matches approved content

Recommended

A subject line that drifts from what was approved is the most visible mistake a send can make; the received subject must match your approved subjects, contain the phrases you require and avoid the patterns you prohibit (skipped until you configure it).

Typography follows approved brand rules

Recommended

An off-brand font stack is the fastest way an email stops looking like it came from you; every font stack must match an approved brand stack, webfonts must carry an Outlook fallback, and weights and sizes must use vocabulary mail clients honour (skipped until you configure it).

Link UTM and query parameters inventoried

Recommended

Knowing exactly which tracking parameters each link carries is how you spot the one campaign that will not attribute; this lists every link's query parameters with the UTM keys called out, and always passes — it reports, it does not judge.

UTM tags follow the SchemaFirst UTM Standard

Recommended

When two people tag the same campaign differently, one campaign reports as several and nobody can say what it earned; every tagged link must follow the SchemaFirst UTM Standard — source, medium and campaign all present, the campaign a lowercase underscore slug that does not repeat the source or channel, and every value lowercase with no spaces — on top of the tracking integrity rules for merge tags, click IDs, personal data and dropped parameters.

Email still legible with images off

Recommended

Outlook shows images blocked to every recipient who has not added you to Safe Senders; the email must still convey its offer and give the reader a way to act with images off (requires the alt-text validation, which covers the other half of the same question).

Webpages

17 checks across 6 sets

Accessibility

1 check

Body text stays in a readable size range on the page.

Brand

2 checks

Logo and footer present as the brand requires.

Change detection

1 check

The page is compared to the last capture of the same URL and width.

Content

1 check

Placeholder copy such as lorem ipsum is not on the page.

Performance

1 check

Load time is measured from the browser clock.

More webpage checks

11 checks

Additional listed checks for webpage subjects.

Images have a text alternative

Required

A screen reader announces an image with no text alternative as a file name or not at all, so whatever it showed is lost; every meaningful image must carry alternative text and every decorative one must be marked as such.

Motion stops when the reader asks

Recommended

Endless carousels, looping backgrounds and spinning graphics make some readers dizzy or ill and pull everyone’s eye away from the words; motion lasting more than five seconds must stop when the reader’s device asks for reduced motion.

Keyboard focus is visible

Required

A keyboard user who cannot see where focus is cannot tell which link Enter will follow; every element must show a visible change when it receives keyboard focus.

Form fields are labelled

Required

A screen reader announces an unlabelled field as just "edit text", so the visitor cannot tell what to type and abandons the form; every input, select and toggle must carry a programmatic label.

Everything works from the keyboard

Required

People who cannot use a mouse — and every screen-reader user — move through a page with the keyboard; a control it cannot reach or a spot it cannot leave stops them dead, so every control must be reachable with Tab and focus must never get stuck.

Page declares its language

Required

Without a declared language a screen reader reads the page in the listener’s own language and mispronounces every word; the page and any passage in another language must say which language they are in.

Links say where they go

Required

A screen-reader user skimming a list of links hears "link" or a row of identical "learn more"s and cannot tell them apart; every link must have a name, and a generic one needs the words around it to say where it goes.

Form fields stand out from the page

Recommended

A text box whose outline is a faint grey on white is invisible to people with low vision, who cannot find where to type; the border or fill that shows where a field is must reach a 3:1 contrast with what surrounds it.

Tap targets are large enough

Recommended

A link or button too small to hit gets mis-tapped by anyone with a tremor and by most people on a phone; every target must be at least 24 by 24 pixels or have that much clear space around it.

Text has enough contrast

Required

Text too close in colour to its background is unreadable for people with low vision and for everyone in bright light; normal text must reach a 4.5:1 contrast ratio and large text 3:1.

Videos have captions

Required

A video with no captions says nothing to a viewer who is deaf, hard of hearing, or watching with the sound off; every video with sound must offer synchronised captions.

Common questions

What is a Validation?
A Validation is a single opinionated check — visual or functional — that ArbiterQA runs against an email or webpage and returns as pass, fail, or error with evidence attached.
What is a Validation Set?
A Validation Set is a curated group of checks that protect one outcome, such as brand compliance or accessibility. Selecting a set runs every check it contains.
Can I customize what a check enforces?
Checks with custom configuration let you replace the Standard default with your own rule — your logo requirement, your footer elements — while keeping the same judgment engine.
How do I run these?
Name the checks or sets through the API, MCP, or the ArbiterQA CLI (@rbtrqa/cli). ArbiterQA renders the subject, runs the checks, and returns a structured verdict your CI or agent can gate on.

Point ArbiterQA at your first check

Agents call the same catalog you see here through the API, MCP, or the ArbiterQA CLI (@rbtrqa/cli). Start free with 1,000 credits.