{
  "id": "OPS-144",
  "slug": "ops-144",
  "title": "Do not rotate domains across a bulk send",
  "statement": "Multiple fully-qualified domains, or multiple public URL shorteners, must not be cycled across bulk messages carrying similar content.",
  "rationale": "URL rotation is the content-side twin of snowshoeing: the domain is what a filter scores, so spreading one campaign across several defeats the scoring in exactly the way the numbers version does. The innocent case is per-channel tracking domains, which is a reasonable analytics decision that produces an identical fingerprint.",
  "layer": "OPERATIONAL",
  "layerSlug": "operational",
  "object": "domains used across a bulk send",
  "severity": "BLOCKING",
  "detectability": [
    "UNDETECTABLE_PRE_SUBMISSION"
  ],
  "failureClass": "HARD_STOP",
  "authorities": [
    "T-Mobile",
    "AT&T",
    "CTIA"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Use one branded domain you control for every link in a campaign, and carry tracking in the path or the query rather than in the hostname.",
  "notes": "Absorbs MSG-109, the same detection stated from the message-content side. Visible only across a real send. What the user has to check is whether their marketing platform issues per-campaign or per-channel domains automatically — several do, and the resulting pattern is indistinguishable from deliberate rotation.",
  "catalogIds": [
    "MSG-109"
  ],
  "phase": "post",
  "automated": false,
  "attestation": {
    "question": "Does your marketing platform issue a different link domain per campaign or per channel?",
    "howToCheck": [
      "Look at the links in two recent campaigns and compare the hostnames. Several platforms rotate automatically, and the pattern is indistinguishable from deliberate evasion.",
      "Use one branded domain you control for every link.",
      "Carry tracking in the path or the query string rather than in the hostname."
    ],
    "failureLooksLike": "Per-channel tracking domains are a reasonable analytics decision that produces exactly the fingerprint of URL rotation — the content-side twin of snowshoeing."
  },
  "url": "https://ekas.io/rules/10dlc/operational/ops-144/",
  "markdown": "https://ekas.io/rules/10dlc/operational/ops-144.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}