Disclaimer: Involved in building these sort of systems so I can go on about a lot (though not as much detail as I'd like).<p>At this point, most security vendors that handle email do this (or offer it). The main reason for re-writing is its device independent. A browser plugin only gets you so far, and doesn't handle modern needs where devices that have mail access will be unmanaged.<p>The tradeoff is yeah, the URLs are ugly. There's a balance between highlighting where the URL goes, embedding the info necessary for redirects, preventing redirect abuse, per user policy, etc.<p>In the end, its all really about buying time. At mail delivery time, you can only get some % of threats. Given there's a gap between delivery, and click time, you can use that to your advantage and at least prevent some % of the user base being exposed to bad stuff.<p>On top of it all, you have all sorts of edge cases like what to do with things that aren't URLs, but mail clients turn into clickable links. What about URLs in attachments? \o/ Time to run away.