Does Apple Mail Privacy Protection create false opens?
Yes. Apple Mail can download the tracking image through Apple’s servers without the person opening the email. HawkOpen labels such requests as a privacy proxy instead of classifying them as likely human activity.
Why was my link clicked seconds after I sent the email?
Most likely a security scanner did it. Many company mail systems open the links in an incoming email to check them before the person sees the message. HawkOpen counts these as signs of a scanner, never classifies them as likely human activity on that basis, and lists the rule codes behind the verdict.
Does an open prove that someone read my email?
No. An open means that the tracking image was requested. The request can come from a person, a privacy proxy, a mail provider’s image cache or a scanner, and HawkOpen never presents it as proof of reading.
How accurate is email open tracking?
It accurately records that a tracking image was requested, but that is not the same as a person reading. It overcounts when Apple Mail, a mail provider’s proxy or a scanner loads the image, and undercounts when images are blocked, so HawkOpen labels each request instead of counting every one as an open.
Why does my tracker say an email was opened when nobody opened it?
Because something other than a person loaded the tracking image: Apple Mail Privacy Protection, the image proxy of Gmail, Outlook.com or Yahoo, a security scanner or a link preview. HawkOpen shows such events with their category and rule code, and does not classify them as human activity.
Why does one email show many opens?
Each request for the tracking image is recorded as a separate event. A proxy, a scanner, the recipient opening the message again on a phone and a computer, or other people reading a forwarded copy all add events, and HawkOpen lists each one with its time and category.
Why does an open appear seconds after I send the email?
Usually a machine loaded the image: Gmail’s scanner or prefetching, Apple Mail Privacy Protection or a company security filter. HawkOpen has rules for these, such as R-OPEN-GOOGLE-SCAN, R-OPEN-GMAIL-PREFETCH, R-OPEN-APPLE and R-OPEN-FAST, and a fast open alone is never classified as likely human activity.
Why do opens come from Google’s image proxy, and how do I tell them from real ones?
Gmail does not let the reader’s device fetch images directly: Google’s servers fetch them and pass them on, so you see Google’s network instead of the reader’s. HawkOpen marks such requests as proxy cache (R-OPEN-GOOGLE) and marks Gmail’s prefetching and scanning with separate rules.
Does a preview pane count as an open?
Yes, if the preview shows images: the mail program then loads the tracking image just as when the message is opened, and HawkOpen cannot tell a glance in a preview pane from careful reading. A one-line text preview in the message list, without images, records nothing.
What happens if the recipient blocks images?
Then the tracking image is not loaded and no open is recorded, even if the person reads every word. Clicks on tracked links are still recorded, and so are replies on the Pro and Business plans, so a click without an open usually means images were blocked.
What is Apple Mail Privacy Protection?
It is a feature of Apple Mail on iPhone, iPad and Mac that loads remote content of emails privately through Apple’s servers, often in advance, and hides the recipient’s IP address. For the recipient it means more privacy; for the sender, an open from Apple Mail no longer shows whether the person read the message.
Are open rates still reliable after Apple Mail Privacy Protection?
Not as a raw count. For recipients who use Apple Mail with the protection on, an open no longer shows whether they read the message, and no tool can recover their real opens. Look instead at observed opens and clicks, which HawkOpen counts apart from machine and proxy ones, and at replies, and compare them over time.
What is a good email open rate?
HawkOpen does not publish benchmarks, and any single figure deserves caution: since Apple Mail Privacy Protection, raw open rates are inflated and differ widely by audience and mail program. Compare your own results over time, using observed opens and clicks, which HawkOpen counts apart from machine and proxy ones, and replies.
Can an email tracker show the recipient’s location?
Not precisely. A tracker sees the network address that loaded the image, which at best suggests a country, and with Apple Mail or Gmail it is the address of their servers, not of the person. HawkOpen resolves an address at most to a country, never to a city or street.
Can I tell if my email was forwarded?
Not reliably. A forwarded copy usually carries the same tracking image and links, so when the new reader opens it, the event is recorded under the original recipient. HawkOpen does not report forwarding of ordinary emails.
Why do I see an open when I look at my own sent email?
Because your copy in the Sent folder can contain the same tracking image. If your mail program loads it, HawkOpen records an event like any other; it does not recognise that the open was yours.
Can I exclude my own company network or colleagues from tracking?
You can exclude recipients, not networks: in your settings, list addresses or whole domains (for example your company’s) and countries that are never tracked. HawkOpen has no list of IP addresses to ignore, so your own opens are not filtered out.
An excluded address or domain gets a plain email with no tracking image and no tracked links, so internal emails to colleagues create no events at all.
If you open your own tracked message, from the Sent folder or a copy, it is recorded like any other request. Check the time and category of the event, or test by sending to a second address of yours.
Related questions: Why do I see an open when I look at my own sent email? · Why does one email show many opens?
Can I tell a bounced email from an unopened one?
Yes. A bounce is recorded as its own delivery status, separate from opens: a hard bounce shows the message as rejected, while an email that was accepted but never opened simply has no open events.
HawkOpen distinguishes hard bounces (the address does not exist or refuses mail) from soft ones (a temporary problem such as a full mailbox). No open, on the other hand, does not mean nobody read the email: the recipient may block images.
Related questions: Does HawkOpen confirm that an email was delivered? · What happens if the recipient blocks images?
What do “likely”, “possible” and “unknown” mean in a HawkOpen verdict?
Every verdict has a category and a confidence of “likely” or “possible”; there is no “certain”. “Unknown” means no rule explained the event, so HawkOpen classifies it neither as a machine nor as likely human activity.
“Likely” means strong signs point one way, such as Apple’s relay network or several human signals together. “Possible” means weaker signs, for example a mail program on a home network: it may be human activity, but that is not settled.
Use “unknown” and “possible” events as hints only. A reply is the only kind of signal that comes from the recipient’s own action.
Related questions: What categories can an open or click have? · What counts as a likely human open or click, and what should I do with it? · Does an open prove that someone read my email?
What is the image at the end of the message used for?
It shows whether the mail app displayed the whole message. Gmail, for example, clips long emails; if the second image at the very end loads, the message was shown to the end. It never counts as an extra open.
In the message details you see the time the end of the message was first displayed. If it never appears while opens do, the email may have been clipped, so the end, with any link or signature there, was not shown. Keep important links near the top.
Related questions: Why does one email show many opens? · What is an email tracking pixel?
Does HawkOpen confirm that an email was delivered?
It confirms what it can see: that the sending server accepted the message, or that it bounced. It does not claim that the email reached the inbox, because the receiving side does not report that.
Each recipient has a status: prepared, accepted by the sending server, or rejected. “Accepted” is not delivery to the inbox: the message can still land in spam or bounce later. A delivery receipt from Outlook has the same limit: it depends on the receiving server.
Opens, clicks and replies come on top, each with a category. A reply is the clearest sign the email arrived and was read.
Related questions: What is the difference between a delivery receipt, a read receipt and open tracking? · How can I prove that an email was sent or received? · Can I tell a bounced email from an unopened one?
Can I see exactly when the email was opened?
Yes: every event in the message timeline has its own date and time, together with its category and rule codes. The time is when the image was requested, which is not always when a person looked at it.
Apple Mail and Gmail may load the image in advance, and scanners act within seconds of delivery, so the first event is often a machine. Look for later events classified as possible or likely human activity.
Related questions: Why does an open appear seconds after I send the email? · Which time zone are times shown in?
Can tracking show how long someone read the email?
Not for an email. HawkOpen records when the tracking image was requested, not how long the message stayed open. Time per page is measured only for a PDF shared as a link, once the reader agrees on the page, and file sharing waits for the malware-scanning service, which is not switched on yet.
Several opens of one email can mean the person came back to it, or that a proxy, a scanner or a second device loaded the image. Check the category of each event before reading anything into the count.
Related questions: Why does one email show many opens? · Can I see exactly when the email was opened?
How many classification rules are there, and what happens to old events when rules change?
More than 40 named rules, and every verdict records the version of the rules that produced it. HawkOpen keeps the signals of each event, so they can be classified again under a newer version; the earlier verdict stays stored next to the new one.
Rules change when mail providers change how they fetch images, for example a new proxy or scanner. A changed threshold always means a new version number, so you can tell which rules a verdict came from. The message details show the newest verdict for each event.
Related questions: What are rule codes such as R-OPEN-APPLE and R-CLK-BURST? · How accurate is email open tracking?
What counts as a likely human open or click, and what should I do with it?
An event that no rule attributes to a machine and that shows signs of human activity, such as a mail program on a home or office network, or a click with a real, visible browser. It is still an estimate, so treat it as a good moment to follow up, not as proof.
Such an event does not send a notification on its own; on the Pro and Business plans an alert rule, for example several opens in a short time, can tell you about it. A click is usually a stronger signal than an open because a person chose that link.
A good follow-up refers to what the link was about, without saying that you saw the open. If you need a decision, ask a clear question so a reply is easy.
Related questions: What do “likely”, “possible” and “unknown” mean in a HawkOpen verdict? · What is the difference between an open and a click? · Does an open prove that someone read my email?
Does HawkOpen recognise Microsoft and Yahoo image proxies?
Yes. Requests from Microsoft’s and Yahoo’s image proxies get the category proxy cache, with the rule codes R-OPEN-MSPROXY and R-OPEN-YAHOO, and do not trigger notifications.
Such a proxy fetches the image on the reader’s behalf and hides their network. The request may follow a real open, but it may also be the provider caching the image, so HawkOpen does not classify it as human activity. Gmail’s proxy is handled the same way.
Related questions: Why do opens come from Google’s image proxy, and how do I tell them from real ones? · What categories can an open or click have?
Does Apple Mail Privacy Protection pre-fetch links or only images?
Apple’s feature loads remote images, including tracking images, through Apple’s servers; HawkOpen marks those loads with R-OPEN-APPLE. Clicks are judged separately by the click rules, so an Apple image load never turns into a click.
If clicks arrive within seconds of delivery or several at once, they usually come from a company security filter, not from Apple; HawkOpen marks those as a security scanner.
Related questions: Does Apple Mail Privacy Protection create false opens? · Why was my link clicked seconds after I sent the email?
What categories can an open or click have?
Seven: Apple Mail Privacy Protection, prefetch (such as Gmail’s), link preview, security scanner, proxy cache, human, and unknown. Each comes with a confidence and the rule codes behind it.
The first five are machines: they stay in the list but never fire an alert, and the numbers and reports count them apart, as machine or proxy opens and scanner clicks. Human means the event is classified as human activity, at most “likely”. Unknown means no rule explained the event. In the numbers an event with no sign of a machine counts as observed, which does not mean that a person was there.
Related questions: What do “likely”, “possible” and “unknown” mean in a HawkOpen verdict? · What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?
Can I manually correct a classification?
No. HawkOpen has no manual override: every verdict comes from the rules, and the same signals always give the same result, with the rule codes shown so you can judge it yourself.
If the rules change, stored signals can be classified again under the new version. To keep internal emails out of tracking altogether, exclude your company’s domain in the settings.
Related questions: How many classification rules are there, and what happens to old events when rules change? · Can I exclude my own company network or colleagues from tracking?
What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?
Each code names one rule that matched the event: R-OPEN-… for opens and R-CLK-… for clicks. For example, R-OPEN-APPLE is Apple’s relay, R-CLK-BURST is three or more links clicked within two seconds, R-CLK-HEADLESS a browser with no window, and R-CLK-JS a real, visible browser.
There are more than 40 such rules. Most add points towards a machine; a few, like R-OPEN-CLIENT and R-CLK-JS, point towards human activity. The category comes from all the rules that matched, so read the codes when a verdict surprises you.
Related questions: What categories can an open or click have? · How many classification rules are there, and what happens to old events when rules change? · How does HawkOpen detect headless browsers and bots?
How are opens and clicks from VPN, cloud or hosting networks treated?
As likely machines. A request from a cloud or hosting network counts towards a scanner (rules such as R-OPEN-CLOUD and R-CLK-HOSTING), and a click from such a network is never classified as likely human activity, whatever other signs it shows.
Activity of a real person on a VPN that runs in a data centre will therefore not be classified as human activity. This is deliberate: it is better to miss human activity than to classify a scanner as human. A reply still counts.
Related questions: Why was my link clicked seconds after I sent the email? · What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?
Why are my email open rates going down?
Often because of measurement rather than readers: more people and companies block remote images, and tools that count machine and proxy opens apart from observed ones, as HawkOpen does, show fewer opens than tools that count every image load.
Compare periods with the same way of counting, and watch clicks and replies alongside opens. If bounces rise at the same time, check delivery as well.
Related questions: What is a good email open rate? · Are open rates still reliable after Apple Mail Privacy Protection? · What happens if the recipient blocks images?
What is the difference between an open and a click?
An open is a request for the invisible tracking image; a click is a request for a tracked link. Each gets its own category, and a click usually tells you more because someone, or something, chose a link.
Opens disappear when images are blocked, and privacy proxies create opens without a person. Clicks still work with images blocked, but company security filters click links too. Read both together, and the category of each.
Related questions: What counts as a likely human open or click, and what should I do with it? · What happens if the recipient blocks images? · How do I track link clicks in my emails?