Work laptops that rewrite referral links

Many company email systems rewrite every link in incoming mail so that clicks pass through a security checker first. Microsoft’s Safe Links rewrites links to an address beginning https://nam01.safelinks.protection.outlook.com (the region part varies), and Proofpoint’s URL Defense rewrites them to https://urldefense.com/…. The original Starlink referral link is carried inside, encoded, and after the check you’re normally sent on to it, so the referral usually survives. But you can’t confirm that from the email. Read the final address bar on starlink.com for ?referral=RC- and the code, and if you can, open the link on a personal device instead.

What security tools do to links

Two of the most common tools in US workplaces describe their behavior publicly.

Microsoft Safe Links (part of Microsoft Defender for Office 365). Microsoft’s documentation says scanned URLs are rewritten or wrapped using the Microsoft standard URL prefix: https://<DataCenterLocation>.safelinks.protection.outlook.com, and that clicking a rewritten link scans it before directing you to the page. It also notes that you normally see the original link text in the email, and that hovering shows a pop-up with the original URL. Rewriting happens per recipient, including when a message is forwarded.

In Microsoft Teams and supported Office apps, Microsoft says links are checked when you click them but not rewritten, so a link shared in Teams usually looks normal.

Proofpoint URL Defense. University IT departments that use it describe the same idea: it rewrites scanned URLs to Proofpoint’s standard URL format https://urldefense.com/. In HTML email you see the normal link text, and hovering reveals the rewritten address; in plain-text email, you see the rewritten address directly.

Other email security products work in similar ways. Your company may use one, several or none.

What that looks like for a referral link

Inside a wrapped link, the original address is percent-encoded: characters that have special meaning in a web address are replaced with codes. The two that matter for a referral are:

So www.starlink.com%2Fresidential%3Freferral%3DRC-… inside a Safe Links address is just www.starlink.com/residential?referral=RC-… in disguise. If you see referral%3DRC- in there, the code is present in the wrapped link.

Where it can go wrong

Rewriting usually works. The failure points are around it:

1. Copying the wrapper instead of the link. If you right-click and copy a link from a work email, you may copy the security address, not the referral link. Paste that into another browser or send it to someone else, and it may fail, expire, or reveal that it came through your employer’s mail system.
2. A blocked or held link. If the security service can’t finish scanning, or classes starlink.com links as suspicious for some reason, you might see a warning or an error page rather than starlink.com. Microsoft documents several warning pages, including “scan in progress” and an error page when a URL can’t be opened.
3. Double wrapping. Forwarded messages, or mail that passes through two security systems, can wrap a link twice. Microsoft notes that another service wrapping links first can prevent Safe Links from processing them.
4. Web filters on the work network. Separate from email, some employers filter browsing. A filter could block starlink.com, or strip parts of addresses.
5. Switching devices. Opening the link on your work laptop, then ordering at home on your own computer, means the home computer never saw the code.

How to see the real link

Hover first

On a work computer with Outlook, hover over the link. Microsoft says Safe Links shows a pop-up with the original URL. Read it against our anatomy of a referral link: starlink.com, then ?referral=RC- and the code.

Click, then read the address bar

If you click, let the security check finish, and then look at the address bar of the page that loads. You should be on starlink.com, with the full referral link in the bar. If it’s all there, that’s your clean link. You can copy it from the address bar (not from the email) if you need it again.

Use the checker

Paste the original link (from the hover pop-up, or from the address bar after it loads) into our link and code checker. It runs in your browser and doesn’t send what you paste anywhere. It flags links that aren’t starlink.com and ones without a code.

Better device choice

For a personal purchase like Starlink, a personal device is simply the better place to open a referral link:

• No rewriting. Personal email accounts may scan links too, but the wrapping described above is a business feature.
• No work filters or monitoring. Your employer’s software may log browsing on a managed laptop. Your Starlink order includes your home address and payment details.
• One device, one sitting. You’ll probably order at home anyway. Opening the link there means the browser that sees the code is the one you’ll pay in.

If the link was sent to your work email, ask the sender to resend it to a personal address or by text. Or, if you’ve already opened it on your work computer and the address bar showed the full link, send that clean link to yourself.

Step by step: from work email to a clean order

1. In your work email, hover over the link and check it points to starlink.com with ?referral=RC-….
2. Ask the sender to resend it to your personal email or phone, or send yourself the clean link from the address bar.
3. On your personal device, open the link in the browser you’ll pay in.
4. Check the address bar: starlink.com, then the referral part, nothing strange at the end.
5. Go through the order screens in that same tab. Before paying, look for “Referral Code Applied”, which a third-party walkthrough reports on the order page when the referral is attached.

For a new customer, a working referral gives one free month of service on the eligible plan you choose, credited to the second bill.

Other places links get checked or changed

Email isn’t the only place a work setup can touch a link:

• Microsoft Teams and Office documents. Microsoft says Safe Links checks links in Teams and supported Office apps when you click them, without rewriting them. A link in a Teams chat or a Word document usually looks normal, but the click goes through a check first.
• Company web filters and proxies. Separate from email, some employers route web traffic through filtering services. These can block sites or show warning pages. If starlink.com is blocked at work, use a personal device on a personal connection.
• Managed browsers. On a company-managed laptop, the browser may have extensions or policies installed by IT. They usually leave addresses alone, but you can’t easily see what they do.
• Forwarding to yourself. Forwarding a work email to your personal address can carry the wrapped version of the link with it. Microsoft notes that rewriting applies even to manually forwarded messages. Copy the clean address from a loaded starlink.com page instead, or ask the sender to resend.

Decoding a wrapped link by eye (without editing it)

You don’t need to edit anything to check whether a wrapped link still carries a code. Look inside it for these strings:

1. starlink.com (it may appear as www.starlink.com after %2F%2F).
2. referral%3DRC- or referral=RC-.
3. The code characters after that, up to the next & or %26.

If all three are there, the wrapped link contains the referral. Opening it and reading the final address bar is still the real test, and the order page’s “Referral Code Applied” line is the final one.

What we don’t know

• Whether every version of every email security product preserves the full referral link through its redirect. Products and settings vary; your IT team configures them.
• Whether starlink.com treats a referral that arrived through a security redirect differently. Starlink doesn’t say. If the final address and the order page both show the referral, we know of no reason it would matter.

What to do next

If the code still isn’t showing, work through our six-question flowchart, then follow the where-to-enter walkthrough.