Six directory emails promised me a dofollow backlink. My 40-line PowerShell verifier said otherwise.

Every few days now, my inbox gets another version of the same email:

"Hi there! 👋 We discovered your product and think it's a great fit. Submit it and get a high-quality dofollow backlink from a trusted domain."

In one evening last week I got six of them. Different brand names, same pitch. And because I'm chasing external-validation signals for an AdSense approval, "dofollow backlink" is exactly the phrase designed to make me click.

I didn't click. I ran a script instead. This post is:

1. Why "dofollow" is worth verifying at all (and why the standard SEO guidance is now stale)
2. The two silent-nofollow discoveries that made me build a verifier (Medium, GitHub)
3. The 40-line PowerShell verifier itself + the header dance to get past bot-detection
4. The newer trap: sites that actively claim dofollow — and how the claim falls apart when you check the submission funnel, not just an existing listing

What "dofollow" means, and why it moves

Every <a href="..."> on the web is either dofollow or nofollow. Google treats them very differently:

• Dofollow (rel doesn't contain nofollow / ugc / sponsored): the source domain vouches for the destination. Passes SEO "link equity." Counts toward the destination's ranking authority.
• Nofollow / UGC / Sponsored: the source domain explicitly declines to vouch. Google largely discounts these for ranking. Still fine for referral traffic and brand exposure — just doesn't move the SEO needle.

For an AdSense-approval situation like mine — where the question is "does this site have external validation from real sources" — dofollow domains matter and nofollow domains are decorative.

The catch: platforms shift policies. What was dofollow in 2020 may be nofollow today, and a cached SEO guide from a few years back gives you the outdated answer with total confidence.

Discovery 1: Medium is now ugc nofollow

I republished a home-loan article on Medium expecting the author-bio + in-article links to be dofollow (per most 2020–2022 SEO guides). Curl'd the live article:

curl -sL "https://medium.com/@author/article-slug" `
  -A "Mozilla/5.0" | Select-String -Pattern 'smarttaxcalc'

Result on every anchor:

<a class="z rm" href="https://smarttaxcalc.in/..." rel="noopener ugc nofollow" target="_blank">

That rel="noopener ugc nofollow" is Medium's current platform-wide default (rolled out ~2023–2024 to kill SEO spam). Every outbound link on Medium is nofollow now, including your author-bio link.

Discovery 2: GitHub READMEs are nofollow too — even in your own fork

Same day, I forked an "awesome-personal-finance" repo, added my site, and pushed. Standard advice says: "even if the PR isn't merged, your fork's README anchor is a dofollow link from github.com." Curl the rendered README:

<a href="https://mint.intuit.com/" rel="nofollow">Mint</a>
<a href="https://smarttaxcalc.in" rel="nofollow">SmartTaxCalc</a>

Every external anchor on any GitHub-rendered README is rel="nofollow", platform-wide, since ~2020. Even Mint — a heavyweight fintech domain — is nofollow on the upstream repo. Nothing you can do overrides it.

Both discoveries invalidated ~30 minutes of prep in one afternoon. Both would have been caught by a 30-second check before the work.

The lesson: verify the rel before you write

Fetch any existing outbound link on the target platform, look at its rel. If it contains nofollow, that's the blanket policy — no author, no article, no PR overrides it. I didn't want to remember to do this manually every time, so I wrote it into my weekly analytics script.

The verifier — 40 lines of PowerShell

The core loop, minus try/catch scaffolding:

$siteHost = ([Uri]$config.siteUrl).Host   # e.g. "smarttaxcalc.in"

foreach ($src in $config.knownReferringUrls) {
    $resp = Invoke-WebRequest -Uri $src -UseBasicParsing -TimeoutSec 20 `
        -Headers $browserHeaders   # see next section for the header set

    # Match every anchor pointing to our host
    $pattern = '<a[^>]*href="[^"]*' + [regex]::Escape($siteHost) + '[^"]*"[^>]*>'
    $anchors = [regex]::Matches($resp.Content, $pattern,
                [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)

    foreach ($m in $anchors) {
        $tag = $m.Value
        $rel = if ($tag -match 'rel="([^"]*)"') { $Matches[1] } else { '' }

        # Dofollow = no nofollow, no ugc, no sponsored in rel.
        # rel="noopener noreferrer" is fine — security attributes, not SEO.
        $isDofollow = -not ($rel.ToLower() -match '\b(nofollow|ugc|sponsored)\b')

        [pscustomobject]@{
            sourceUrl  = $src
            rel        = $rel
            isDofollow = $isDofollow
        }
    }
    Start-Sleep -Milliseconds 500   # polite pause between hosts
}

config.knownReferringUrls is just a list of URLs where you've published or shared a link back — Medium articles, Dev.to posts, forum threads, directory listings, whatever. Output feeds a scorecard row in my weekly insights.md:

| Dofollow referring domains | 1 | ≥ 5 | 🔴 |

The header dance for Cloudflare-fronted sites

A bare Invoke-WebRequest gets 403'd instantly on Medium, Quora, and anything behind Cloudflare. Even -UserAgent 'Mozilla/5.0' isn't enough. This header set gets me through most sites:

$browserHeaders = @{
    'User-Agent'                = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36'
    'Accept'                    = 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8'
    'Accept-Language'           = 'en-US,en;q=0.9'
    'Sec-Ch-Ua'                 = '"Chromium";v="121", "Not A(Brand";v="99"'
    'Sec-Ch-Ua-Mobile'          = '?0'
    'Sec-Ch-Ua-Platform'        = '"Windows"'
    'Sec-Fetch-Dest'            = 'document'
    'Sec-Fetch-Mode'            = 'navigate'
    'Sec-Fetch-Site'            = 'none'
    'Upgrade-Insecure-Requests' = '1'
}

The Sec-Ch-Ua* and Sec-Fetch-* headers are what Chrome sends automatically that a bare HTTP client doesn't. Even with the full set, some sites still block on a TLS-fingerprint check Invoke-WebRequest can't spoof — for those the verifier reports ❓ Unknown (fetch blocked) rather than misclassifying. When it can't confirm, it says so.

The newer trap: when the site emails you claiming dofollow

Discoveries 1 and 2 were silent nofollow — platforms that quietly changed policy. The newer pattern is louder: directory sites that email you promising "a high-quality dofollow backlink from a trusted domain." That's the actual selling point in the pitch.

So I did what the verifier taught me — checked an existing listing on one of these networks before submitting. And here's the twist that makes this worth a whole section: the existing listing checked out. Outbound product links carried:

rel="noopener noreferrer"

No nofollow, no ugc. By the rule above, that's dofollow. Naive verdict: "great, submit."

Then I opened the actual submission form. That's where it fell apart:

• The free tier's dofollow was conditional. You got it only if your product hit a top-3 daily ranking (which needs a vote campaign), or you embedded their badge on your site — i.e. a reciprocal link exchange, which is a named Google link-scheme pattern, not a free win.
• The "guaranteed dofollow" was a paid tier. Buying a dofollow link is, again, squarely against Google's link-scheme guidelines — the last thing you want pointing at a site mid-review.
• The free launch slots were exhausted on every available date. The date picker showed "0 free slots" for every day in range. The paid tier's headline perk? "Skip the free queue." The free path wasn't a path; it was a funnel.

The same operator, it turned out, ran several of these under different brand names and emailed me from each. Live listings looked dofollow; the submission was gated behind a condition or a payment.

The lesson upgrade: verify the funnel, not just a listing

Checking an existing listing's rel is necessary but not sufficient. A network can serve genuinely dofollow HTML on its live pages while gating new free submissions behind:

• a ranking condition you can't meet without vote-farming,
• a reciprocal-badge requirement (link scheme), or
• a paid tier (paid link = link scheme).

So the check I run now has two steps:

1. Listing check (the script above): does an existing outbound link carry a clean rel?
2. Funnel check (manual, 2 minutes): open the submit form. What tier grants the dofollow? Is the free tier actually available (slots), or zeroed out to push you to pay? Does "free dofollow" require a badge/reciprocal link?

If step 2 says "dofollow only via payment or reciprocity," the answer is no — regardless of what step 1 showed. A paid or reciprocal dofollow isn't just low-value; it's an active risk if Google is looking at your link profile.

Why this matters more than a one-off check

Platform policies drift one-way, and you find out via ranking drops, not announcements: LinkedIn nofollow ~2016, Twitter 2019, Quora 2022, Medium ~2023–2024, GitHub READMEs ~2020. Any pre-2023 SEO guide is potentially wrong about at least one. And the newer directory-spam layer means the claim of dofollow is now marketing copy, not a fact — the fact lives in the rel attribute and the submission funnel.

Two rules I now live by:

• Nobody's claim of "dofollow" counts. The rel attribute counts.
• An existing listing's rel isn't the offer. The submission tier is the offer — check it.

Steal the pattern

The verifier runs alongside my GSC / GA4 / Bing / PageSpeed fetches — one script, one double-click, all marketing signals in one place. Two changes to fit your setup:

1. Point $config.siteUrl and $config.knownReferringUrls at your domain + your list.
2. For 403-heavy platforms, either add retry logic or just report them Unknown (I do the latter — I already know their policies).

If you're a solo founder shipping links across platforms and hoping some count toward SEO: run the listing check weekly, run the funnel check before every submission, and stop being surprised.

---

I'm Chetan Sanghani, building SmartTaxCalc.in — a free, browser-based Indian tax + finance calculator platform. Previously wrote about Google's MathSolver JSON-LD validator quirks, dropping mobile LCP under 2s on Blazor WASM, and a self-cleaning Product Hunt teaser banner.