Guide

Mailto links, encoding, and spam protection — the complete guide

The humble mailto link is one of the oldest interactive elements on the web — and still the fastest way to turn a website visitor into an email in your inbox. This guide explains how mailto links work under the hood (RFC 6068), why encoding matters, how to keep your address away from spam harvesters, and when a QR code beats a clickable link. Prefer the shortcut? Use our Mailto Link Generator to build them in seconds.

What a mailto link is

A mailto link is a hyperlink whose target starts with the mailto: scheme instead of https:. Clicking it tells the operating system to open the default email app with a new draft. The simplest form names one recipient: mailto:hello@example.com. Add a question mark and you can prefill the message — subject, body, cc, and bcc — exactly like filling in a form, except the “form” is the visitor’s own email client.

That last point is the real power of mailto links: there is no server to run, no spam filter to configure, and no privacy policy to write for submitted data. The email is composed and sent from the visitor’s account, so delivery reputation, threading, and replies all behave like normal email.

RFC 6068: the anatomy

RFC 6068 (published 2010, updating the original 1998 spec) defines the format. The address part comes first — one or more recipients separated by commas. Then an optional query string carries the headers:

• subject= — the email subject line.
• body= — the prefilled message text; line breaks become %0A.
• cc= and bcc= — extra recipients, comma-separated like the main address list.

A full example looks like this: mailto:sales@example.com?subject=Quote%20request&body=Hi%2C%0A%0APlease%20send%20a%20quote. Notice every space is %20 and every line break is %0A — that encoding is not optional decoration; it is what keeps the link parseable.

Encoding rules that break links when ignored

Three encoding mistakes cause nearly every broken mailto link. First, raw spaces: a space in a subject truncates or corrupts the link in many clients — always encode it as %20, never as + (the plus convention belongs to HTML form submissions, and email clients read a literal plus sign). Second, unencoded & and ? inside a subject or body: these are URL control characters, so an “R&D” subject splits your link into a bogus extra parameter unless encoded as %26. Third, line breaks: pressing Enter in a body field must become %0A (or %0D%0A), or the body collapses into one unreadable line. A proper generator handles all three automatically.

Spam obfuscation: hiding from harvesters

The moment you publish a plain address, harvester bots add it to spam lists. The defenses form a spectrum. At the weak end, writing “name at example dot com” defeats only the dumbest scrapers while annoying every human. In the middle, JavaScript that assembles the address at runtime defeats static scrapers but fails for visitors with scripts disabled. At the strong-but-simple end sits HTML entity obfuscation: each character of the mailto URL becomes a numeric character reference. The page source contains no “@”, no “mailto:”, nothing a regex can match — yet the browser decodes it into a perfectly working link before the user ever clicks.

Be honest about the limits: a scraper that renders pages like a real browser can still extract the address, and nothing stops a human from copying it. Obfuscation is a filter, not a vault — it eliminates the bulk automated harvesting that causes most spam, which is exactly the threat a public contact link faces.

QR codes: mailto for the physical world

A QR code is just text in a scannable picture — and that text can be a mailto link. The use cases write themselves: a business card whose scan opens a pre-addressed email, a restaurant table tent for feedback with the visit details prefilled, a conference badge for “email me the slides” requests. Because phones open the code directly in the mail app, the recipient never types an address. Keep the encoded link short (long bodies make dense, hard-to-scan codes) and always test the scan on both iOS and Android before printing a batch.

When not to use a mailto link

Mailto links are not a universal replacement for forms. Skip them when you need attachments (RFC 6068 excludes them), when the audience may have no email app configured, when you must validate or store submissions, or when the prefilled content is long — some clients truncate very long mailto URLs. For everything else — quick contact, prefilled support drafts, reply links in newsletters — mailto is the lightest tool that does the job.

FAQs

Build your link now with the free Mailto Link Generator — or create the messaging equivalent with the WhatsApp Link Generator.