A guy I’ll call Mike runs a 14-person digital agency in the Midwest. Last March, he messaged me at 11pm: “We’ve got a problem.”

One of his SaaS clients, the kind that funds half the agency’s payroll, had just pulled their full SEO retainer. The reason wasn’t bad rankings or a missed deadline. It was a manual action notice in Google Search Console. Unnatural links. Mike hadn’t placed those links. His previous link building vendor had. The vendor had stopped responding two months earlier.

That story is not unusual. It’s the most common conversation I have with agency owners.

The short version: If you’re an agency buying link building from a vendor, the right way to vet them goes past Domain Authority. Check five things: transparency in sourcing, quality control on every placement, content integrity, reporting that shows where every link came from, and a clear line on what they will and won’t do. Cheap always costs more on the back end. The full 25-point vetting checklist is below.

TL;DR

• Google’s Site Reputation Abuse policy went live in May 2024 and the manual action enforcement has not slowed down. Sites running questionable link schemes have lost rankings overnight.
• Domain Rating and Domain Authority alone are a single variable in what is at least a 10-variable problem. Vendors that lead their pitch with “DR 70+ links” are telling you what they sell, not what works.
• In white-label audits I’ve sat in on, the most common source of toxic links on a client site is a previous “white-label” vendor the agency forgot they used.
• The five quality signals below filter out roughly 80% of bad providers in the first 30 minutes of a call. The rest of the work is making sure the good ones stay good.
• The checklist below is the same one we use internally before recommending a partner.

Why this matters now

The link building market in 2026 is more crowded than it has ever been, and a lot of that growth is bad supply. Anyone with a virtual assistant, a Slack channel, and a spreadsheet of “publishers” can call themselves a link building service. The barrier to entry is essentially zero. The barrier to running a clean, durable operation is high. That gap is where agency owners lose money.

The risk is not theoretical. Google has been more public about link-related manual actions in the last 18 months than in the previous five years combined. The November 2024 update on site reputation abuse, the policy clarifications around parasite SEO, and the increased crawl attention on guest post networks have all made the cost of buying bad links much higher than the cost of avoiding them.

The point of this piece is not to scare anyone off link building. Links still matter. They matter for traditional SEO, and they correlate with citation visibility in AI search. What’s changed is the cost of getting it wrong. So here are the five signals I look for, and the questions I ask, before I trust any provider with a client’s domain.

Signal 1: Transparency in sourcing and outreach

A legit link building service can tell you, in plain English, where their links come from. A bad one can’t, or won’t.

Here’s the test. Ask a vendor: “Walk me through how you sourced the last ten placements you delivered.” A good vendor has a clear answer. They build relationships with editors at niche publications. They run digital PR campaigns that earn coverage. They run guest post outreach to specific sites their writers have a real relationship with. They have outreach sequences they can show you. They have email reply rates they can quote. The whole thing is auditable.

A bad vendor will get vague. They’ll talk about a “network.” They’ll talk about “private inventory.” If you press, you’ll get told the methodology is proprietary. Proprietary is sometimes a real word. In the link building world, in my experience, it usually means “we’d rather not show you the spreadsheet of paid sites we use, because once you saw it, you’d see we’re using the same one as eight of your competitors.”

Specific things I want to see:

• A documented outreach process, not a black box
• Examples of recent placements with the actual outreach email that earned them
• Honest answers about which sites are paid placements vs. earned coverage
• A willingness to name the publications they have relationships with

In around 60% of partner conversations I have, a vendor declines to share even the most basic of this. That declination is the answer.

Signal 2: Quality control beyond Domain Authority

Domain Authority and Domain Rating are useful. They’re not enough. A site with DR 75 can still be a terrible link source if its DR comes from a manipulated backlink profile, if its traffic is fake, if its content is AI-spam, or if it sells links to anyone with a credit card.

The vendors that sell on DR alone are gaming the easiest variable they can game. The variables that actually predict whether a link helps a client are messier.

Here are the ones I check:

• Real organic traffic from the host site, ideally to the page where the link will sit. A DR 70 site with 200 monthly organic visits is a graveyard. Use Ahrefs or Semrush to confirm.
• Topical relevance to the client’s site, not just to the broad industry. A general “marketing” site is not as relevant as a site that specifically covers your client’s category.
• Outbound link velocity. If the host site adds 30 outbound links a month and they all go to commercial pages, the site is selling links at scale and Google knows it.
• Content quality on the host page. AI-generated word salad surrounding your client’s link sends a signal nobody wants to send.
• Indexation status. Plenty of “delivered” links sit on pages that Google has dropped from the index. They literally do nothing.

A real link building service runs all five of these checks before placement. A bad one runs the first one (DR) and ships.

Signal 3: Content integrity

The link is only half the deliverable. The other half is the content the link sits inside. If that content is bad, the link is bad, no matter how high the DR.

I run into three patterns of bad content from cheap providers, and they’re all easy to spot once you know what to look for:

The first is generic AI output. Posts written entirely by a language model with no editorial oversight, no specific examples, and no real point of view. These get indexed at lower rates, they get less time on page, and they decay fast. They also tend to live on host sites that publish 12 of these a week, which compounds the problem.

The second is content that has nothing to do with the link target. The article is on, say, “best practices for HVAC SEO,” and there’s a contextless mention of a B2B SaaS tool buried in paragraph six. That’s not a link in context. That’s a paid placement disguised as content, and Google’s spam team is very good at recognizing it.

The third is content that’s been spun, paraphrased, or sourced from a content mill at $20 a pop. It reads okay on the surface and falls apart on the second read. It’s the link building equivalent of fast fashion. It costs less, it looks like the real thing, and it falls apart in the wash.

A good link building service treats the content as the actual product. They have writers who specialize in the client’s vertical. They have editors. They review every piece before publication. The link feels like a natural fit because it is one. That’s the difference between an asset and a liability on a backlink profile.

Signal 4: Reporting and accountability

If a link building service can’t tell you, on demand, exactly what they did last month and why, you’re paying for a vibe instead of a service.

What good reporting looks like, in my experience:

• A monthly delivery report with every link, the host site, the anchor text, the target URL, the publication date, and a screenshot or live URL.
• A QA log showing which sites were vetted, which were rejected, and why. (This second one is rare. When I see it, I know the vendor takes their craft seriously.)
• An indexation check 30 days after placement, with the percentage of links that actually got indexed by Google.
• A traffic and ranking impact note, even if it’s directional, that ties the placements to the client’s organic performance.

The reason this matters is straightforward. If something goes wrong six months from now and your client asks “where did all these strange links come from,” you need a paper trail. If your vendor goes out of business, you need to be able to reconstruct what they did and clean up if needed. If the vendor isn’t keeping receipts for you, they’re not keeping receipts for themselves either, and that’s where the disasters come from.

Here is a comparison of what reporting looks like across providers I’ve reviewed:

Element	Bad provider	Adequate provider	Good provider
Delivery report	“Done” in a Slack message	List of URLs	Full table with anchors, dates, screenshots
Vetting transparency	None	Top-line metrics only	Documented vetting decisions
Indexation check	Never	Sporadic	Standard 30-day check
Traffic attribution	Never	Dashboard link	Direct correlation with client KPIs
Manual action protocol	None	“We’ll figure it out”	Documented response plan
Communication speed	Multiple-day delay	Same week	Same day

Signal 5: Ethical compliance and a “safety first” line

Every link building service has tactics they won’t use. The good ones have written them down. The bad ones make them up on the call.

Some of the lines I want a vendor to draw clearly:

• Will they place links on private blog networks? (Answer should be no, not “depends.”)
• Will they buy links on link-selling marketplaces with mixed reputations? (Answer should be no.)
• Will they use exact-match commercial anchor text? (Answer should be: only when the client specifically requests it and the placement context supports it. Most agencies want this defaulted to varied anchors.)
• Will they place links on sites flagged by Google’s site reputation abuse policy? (Answer should be no. If they don’t know what that policy is, that’s the answer too.)
• Do they build sitewide footer links, sidebar links, or any kind of bulk-placement product? (Answer should be no.)

Beyond the specific tactics, I want a sense that the vendor takes the client’s site seriously. The phrase I listen for is “we won’t place a link we wouldn’t be comfortable placing on our own site.” It sounds simple. The vendors who say it and mean it are rare. They’re the ones I work with.

This is also the area where Shortlist’s approach diverges most from the cheap end of the market. We document our refusal list in writing for every white-label partner. If a tactic isn’t on the green list, it doesn’t ship. That’s not a marketing line. It’s the actual operating policy, because the alternative, which is cleaning up after someone else’s mistakes, is more expensive every single time.

8 red flags that a link building service is not safe to work with

If any of these come up on a sales call, walk away. The first two are deal-breakers on their own.

1. They lead the pitch with DR or DA only, no other quality variables.
2. They will not name a single publication they have a relationship with.
3. They have a “private network” they won’t describe.
4. They won’t show outreach examples from the last 30 days.
5. They guarantee specific placements on specific high-DR sites.
6. They don’t mention indexation or have a process for it.
7. They use the word “proprietary” in place of an actual answer.
8. They don’t ask any questions about your client’s vertical before quoting.

Where to go from here

If you’re vetting a link building service right now, run them through the five signals before you sign anything. The 25-point checklist below is the practical version. It takes about 30 minutes to use in a vendor call. It will tell you, with high confidence, whether the provider is safe.

If you’d rather skip the vetting process and work with a white-label link building partner who’s already been through every test in this post, that’s what we do at Shortlist. We onboard a small number of agency partners each quarter and we publish our refusal list, our reporting standards, and our pricing in writing before a contract starts. If that sounds like a fit, you can book a 20-minute fit call at shortlist.io and we’ll tell you honestly whether we can help.

Either way: don’t let the cheap option turn into the expensive one six months from now. Mike from the start of this post recovered, eventually. The penalty cost him three months of revenue from his largest client and most of his Q2. The vetting takes 30 minutes.