Email privacy checker

Tracking pixels

A tracking pixel is an image, usually one pixel square and usually invisible, with a unique address. Your mail client fetches it when the message opens. The sender’s server sees that fetch and learns three things: that this specific copy of the message was opened, when, and the IP address it was opened from — which is a rough location, and on a phone a rough movement history if you open it twice.

None of that requires you to click anything. Opening the message is the event.

This is why mail clients block remote images. Gmail proxies them through its own servers, which hides your IP but still reports the open. Apple’s Mail Privacy Protection fetches every image in advance whether you open the message or not, which breaks the signal by flooding it. If your client does neither, the pixel works exactly as designed.

Ordinary remote images

A logo or a product photo is not a tracking pixel, and this page lists them separately for that reason. But the request still happens, still comes from your address, and can still carry a per-recipient token in its path. A sender who wants open tracking does not need a 1×1 image to get it — a normal image with a unique URL does the same job, which is why the host list matters more than the pixel count.

Links that go somewhere else first

A click tracker replaces every link in the message with one pointing at its own server, which records the click and then redirects you on. Almost every mailing platform does this by default, and it is how a sender knows which links in a campaign worked.

It is not by itself dishonest, and this page does not call it that. Two things about it are worth knowing. The tracker sees every link you follow, so a third party now has a record of your reading that neither you nor the sender deliberately gave them. And because the visible text and the real destination are no longer the same thing, the shape that phishing relies on has become normal — you cannot tell a rewritten marketing link from a rewritten malicious one by looking.

What the headers already said

The report ends with what the message disclosed before anyone opened it. The first Receivedline records the machine that handed the message to the first mail server — for mail sent from a desktop client rather than a webmail interface, that is often the sender’s own connection. X-Mailer names the program and its version. X-Originating-IPis some providers stamping the sender’s address in plain sight.

Read that section twice, because it is the part that is symmetrical. Everything it shows you about a sender is on the mail you send.

What this cannot tell you

It cannot tell you a message is safe. It reports what is written in the message, and a tracker that uses an opaque token and no embedded destination is indistinguishable from an ordinary link from the outside. A clean result means this page found nothing, not that there is nothing.

It also does not fetch anything to check. Following a link to see where it goes would be the click the tracker is waiting for, and loading an image to measure it would be the open. Both would use the tool to do the thing the tool is warning you about.

The address is the leak underneath

Every signal above is tied to one thing: the sender already has an address that reaches you, and that address is the same one they can sell, match against a breach, or hand to a data broker. Blocking images is a good habit and it does not change that.

Giving each sender a different address does, which is the thing Maski does. When one of them starts behaving like this, you turn off that one address instead of negotiating with them.