Over the years, I found myself constantly pointing out to organizations that emails containing links with 3rd party domain names that are relatively unknown are problematic. That's how social engineering occurs. For example, surveymonkey is well-known, but survey.alchemer-ca.com not so much.
I'm beginning to wonder how realistic this is. If it's just noise, then there are negative repercussions for being the lone wolf baying at the moon. Organizations typically have more demand than their IT/security staff can service. Requiring that links point to the organization's domain for redirection to a 3rd party service is not feasible in most cases.
A further complication is that it adds yet more process, compromising the agility with which staff achieve outcomes, e.g., conduct polls, surveys, and organize events.
Finally, even if such a process was put into place, unless there is constant reminder of its necessity, it is easy for staff to forget, to make "exceptions", or for new staff to not be indoctrinated into its use.
In view of the challenges, what is a feasible way to avoid the vulnerability to social engineering posed by 3rd party links in emails?