# HawkOpen — Questions and answers (English)
> Short, checked answers about email tracking, read receipts, campaigns, documents and signatures, plans, privacy and the law. Each answer says what the product does today.
> This information is general and concerns the features of HawkOpen (TriStiX S.L.). It is not individual legal advice or an assessment of whether a specific campaign or document complies with the law. Customers make their own decisions about their activities and, where needed, consult a qualified specialist. This does not limit any rights they have under mandatory law.
URL: https://hawkopen.com/en/faq
JSON: https://hawkopen.com/en/faq.json
Checked: 2026-11-13
## Accuracy of opens and clicks
False opens from Apple Mail, clicks made by security scanners and what an open really tells you.
URL: https://hawkopen.com/en/faq/accuracy
### Does Apple Mail Privacy Protection create false opens?
URL: https://hawkopen.com/en/faq/accuracy/apple-mail-privacy-protection-false-opens
Yes. Apple Mail can download the tracking image through Apple’s servers without the person opening the email. HawkOpen labels such requests as a privacy proxy instead of classifying them as likely human activity.
With Mail Privacy Protection switched on, Apple Mail loads remote images through Apple’s relay servers, whether or not the message is ever opened. A tracker that counts every image request therefore shows opens that nobody made.
HawkOpen checks each image request against named rules. A request that matches the Apple rule gets the category **privacy proxy** and the rule code R-OPEN-APPLE, so you can see why it was classified that way. The category is an estimate; it does not tell you whether the person later read the message.
Mail Privacy Protection loads images, not links. A click on a tracked link is therefore not caused by it, although company security scanners can still click; HawkOpen rates every click with its own rules.
Related questions: [What is Apple Mail Privacy Protection?](https://hawkopen.com/en/faq/accuracy/what-is-apple-mail-privacy-protection), [Are open rates still reliable after Apple Mail Privacy Protection?](https://hawkopen.com/en/faq/accuracy/open-rate-after-apple-mpp), [Does an open prove that someone read my email?](https://hawkopen.com/en/faq/accuracy/does-an-open-prove-the-email-was-read)
Checked: 2026-11-11
### Why was my link clicked seconds after I sent the email?
URL: https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending
Most likely a security scanner did it. Many company mail systems open the links in an incoming email to check them before the person sees the message. HawkOpen counts these as signs of a scanner, never classifies them as likely human activity on that basis, and lists the rule codes behind the verdict.
Signs of a scanner include a click within seconds of delivery, several links opened almost at once, requests from the network of a security vendor or a data centre, and requests that do not behave like a real browser. HawkOpen has a named rule for each of these signs.
Every click gets a category, such as **security scanner**, **link preview** or **human**, a confidence of “possible” or “likely”, and the list of rules that matched. A click that comes from a data-centre network is never classified as likely human activity.
Related questions: [Are bot clicks inflating my click rate, and how do I filter scanner clicks?](https://hawkopen.com/en/faq/clicks/bot-clicks-inflate-click-rate), [How do I track link clicks in my emails?](https://hawkopen.com/en/faq/clicks/how-to-track-email-clicks), [Why does an open appear seconds after I send the email?](https://hawkopen.com/en/faq/accuracy/why-open-appears-seconds-after-send)
Checked: 2026-11-11
### Does an open prove that someone read my email?
URL: https://hawkopen.com/en/faq/accuracy/does-an-open-prove-the-email-was-read
No. An open means that the tracking image was requested. The request can come from a person, a privacy proxy, a mail provider’s image cache or a scanner, and HawkOpen never presents it as proof of reading.
HawkOpen classifies each request and gives the verdict a confidence of “possible” or “likely”, never “certain”. When there is too little information, the category is **unknown** rather than human activity.
The strongest sign that a person engaged with your message is something they did themselves, such as a reply.
The same goes for a read receipt or a “read” status: it shows that a program reported the message as opened, which can also happen in a preview pane or when the message is marked as read, and the recipient can refuse to send one.
Related questions: [How do I know if someone read my email?](https://hawkopen.com/en/faq/read-receipts/how-to-know-if-someone-read-my-email), [How accurate is email open tracking?](https://hawkopen.com/en/faq/accuracy/how-accurate-is-email-open-tracking), [Does Apple Mail Privacy Protection create false opens?](https://hawkopen.com/en/faq/accuracy/apple-mail-privacy-protection-false-opens)
Checked: 2026-11-11
### How accurate is email open tracking?
URL: https://hawkopen.com/en/faq/accuracy/how-accurate-is-email-open-tracking
It accurately records that a tracking image was requested, but that is not the same as a person reading. It overcounts when Apple Mail, a mail provider’s proxy or a scanner loads the image, and undercounts when images are blocked, so HawkOpen labels each request instead of counting every one as an open.
**Too many opens:** Apple Mail Privacy Protection loads images in advance, Gmail, Outlook.com and Yahoo fetch them through their own servers, and company filters open messages to check them. **Too few opens:** the recipient blocks images, reads in plain text, or reads a copy the image was already cached for.
HawkOpen gives each request a category, such as **privacy proxy**, **proxy cache**, **security scanner** or **human**, with the rule codes behind it. A verdict is at most “likely”, and a request with no clear signal stays **unknown** rather than human activity. Rules are versioned, and stored signals can be classified again when the rules improve.
In practice, look at opens and clicks classified as likely human activity together with replies, and do not treat any single open as proof.
Related questions: [Why does my tracker say an email was opened when nobody opened it?](https://hawkopen.com/en/faq/accuracy/why-tracker-says-opened-when-nobody-opened), [Does an open prove that someone read my email?](https://hawkopen.com/en/faq/accuracy/does-an-open-prove-the-email-was-read), [What happens if the recipient blocks images?](https://hawkopen.com/en/faq/accuracy/what-if-recipient-blocks-images)
Checked: 2026-11-11
### Why does my tracker say an email was opened when nobody opened it?
URL: https://hawkopen.com/en/faq/accuracy/why-tracker-says-opened-when-nobody-opened
Because something other than a person loaded the tracking image: Apple Mail Privacy Protection, the image proxy of Gmail, Outlook.com or Yahoo, a security scanner or a link preview. HawkOpen shows such events with their category and rule code, and does not classify them as human activity.
Typical codes: R-OPEN-APPLE (Apple Mail loaded the image), R-OPEN-GOOGLE, R-OPEN-MSPROXY and R-OPEN-YAHOO (a provider’s image server), R-OPEN-GMAIL-PREFETCH and R-OPEN-GOOGLE-SCAN (Gmail fetched or checked it in advance), and R-OPEN-PREVIEW or R-OPEN-AI-DECLARED (a chat app or an AI assistant built a preview).
To check a message, open its event list and look at the category of each open. Events marked as a machine do not trigger notifications. An open marked **unknown** is only possible, and a click or reply tells you much more.
Related questions: [Why does one email show many opens?](https://hawkopen.com/en/faq/accuracy/why-one-email-shows-many-opens), [Why does an open appear seconds after I send the email?](https://hawkopen.com/en/faq/accuracy/why-open-appears-seconds-after-send), [Why do I see an open when I look at my own sent email?](https://hawkopen.com/en/faq/accuracy/own-opens-notification)
Checked: 2026-11-11
### Why does one email show many opens?
URL: https://hawkopen.com/en/faq/accuracy/why-one-email-shows-many-opens
Each request for the tracking image is recorded as a separate event. A proxy, a scanner, the recipient opening the message again on a phone and a computer, or other people reading a forwarded copy all add events, and HawkOpen lists each one with its time and category.
A burst of opens within seconds of delivery usually comes from machines. Opens spread over hours or days, from a mail program on a home or mobile network, are more likely a person coming back to the message. Your own views of the message in your Sent folder can also add events.
HawkOpen does not merge these into one number. Look at the category of each event: machine events stay in the list but do not trigger notifications.
Related questions: [Why does my tracker say an email was opened when nobody opened it?](https://hawkopen.com/en/faq/accuracy/why-tracker-says-opened-when-nobody-opened), [Can I tell if my email was forwarded?](https://hawkopen.com/en/faq/accuracy/can-i-tell-if-email-was-forwarded), [Why do I see an open when I look at my own sent email?](https://hawkopen.com/en/faq/accuracy/own-opens-notification)
Checked: 2026-11-11
### Why does an open appear seconds after I send the email?
URL: https://hawkopen.com/en/faq/accuracy/why-open-appears-seconds-after-send
Usually a machine loaded the image: Gmail’s scanner or prefetching, Apple Mail Privacy Protection or a company security filter. HawkOpen has rules for these, such as R-OPEN-GOOGLE-SCAN, R-OPEN-GMAIL-PREFETCH, R-OPEN-APPLE and R-OPEN-FAST, and a fast open alone is never classified as likely human activity.
Gmail often fetches the image from Google’s network shortly after a message arrives, before anyone looks at it. Apple Mail loads it through Apple’s servers in the background. Company filters open new mail to check it. All of this can happen within seconds.
These events are listed, but they never fire an alert, and a single open does not send a notification anyway. A later open from a mail program on a home, mobile or office network is a better sign of human activity, though still only “possible”.
Related questions: [Why do opens come from Google’s image proxy, and how do I tell them from real ones?](https://hawkopen.com/en/faq/accuracy/google-image-proxy-opens), [Does Apple Mail Privacy Protection create false opens?](https://hawkopen.com/en/faq/accuracy/apple-mail-privacy-protection-false-opens), [Why was my link clicked seconds after I sent the email?](https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending)
Checked: 2026-11-11
### Why do opens come from Google’s image proxy, and how do I tell them from real ones?
URL: https://hawkopen.com/en/faq/accuracy/google-image-proxy-opens
Gmail does not let the reader’s device fetch images directly: Google’s servers fetch them and pass them on, so you see Google’s network instead of the reader’s. HawkOpen marks such requests as **proxy cache** (R-OPEN-GOOGLE) and marks Gmail’s prefetching and scanning with separate rules.
A proxy request can be close to a real open, because Gmail often fetches the image when the message is shown, but it is not proof. It also hides the reader’s network and location, and a later reopening may not create a new request.
Clearer machine cases get their own rules: R-OPEN-GMAIL-PREFETCH when Gmail declares that it is fetching in advance, and R-OPEN-GOOGLE-SCAN when an image is fetched from Google’s network shortly after sending. None of these trigger a notification. For a stronger signal, look at clicks and replies.
Related questions: [Why does an open appear seconds after I send the email?](https://hawkopen.com/en/faq/accuracy/why-open-appears-seconds-after-send), [Do read receipts work between Gmail and Outlook?](https://hawkopen.com/en/faq/read-receipts/read-receipts-between-gmail-and-outlook), [Can an email tracker show the recipient’s location?](https://hawkopen.com/en/faq/accuracy/can-email-track-location)
Checked: 2026-11-11
### Does a preview pane count as an open?
URL: https://hawkopen.com/en/faq/accuracy/does-preview-pane-count-as-open
Yes, if the preview shows images: the mail program then loads the tracking image just as when the message is opened, and HawkOpen cannot tell a glance in a preview pane from careful reading. A one-line text preview in the message list, without images, records nothing.
Such an open from a mail program on a home, mobile or office network is classified at most as **possible** human activity. It says the message was displayed, not that it was read.
Previews made by chat apps or AI assistants when someone pastes a link are a different case: HawkOpen recognises many of them by their declared identity (R-OPEN-PREVIEW, R-OPEN-AI-DECLARED) and does not classify them as human activity.
Related questions: [Does an open prove that someone read my email?](https://hawkopen.com/en/faq/accuracy/does-an-open-prove-the-email-was-read), [How accurate is email open tracking?](https://hawkopen.com/en/faq/accuracy/how-accurate-is-email-open-tracking)
Checked: 2026-11-11
### What happens if the recipient blocks images?
URL: https://hawkopen.com/en/faq/accuracy/what-if-recipient-blocks-images
Then the tracking image is not loaded and no open is recorded, even if the person reads every word. Clicks on tracked links are still recorded, and so are replies on the Pro and Business plans, so a click without an open usually means images were blocked.
Images are blocked by the recipient’s own settings, by plain-text viewing, by some company mail systems and by privacy tools. HawkOpen cannot and does not try to get around that.
If you need to know whether a message was acted on, include a link worth opening, and ask a clear question so that a reply is natural.
Related questions: [How accurate is email open tracking?](https://hawkopen.com/en/faq/accuracy/how-accurate-is-email-open-tracking), [How do I track link clicks in my emails?](https://hawkopen.com/en/faq/clicks/how-to-track-email-clicks), [How do I block email tracking?](https://hawkopen.com/en/faq/detect-block/how-to-block-email-tracking)
Checked: 2026-11-11
### What is Apple Mail Privacy Protection?
URL: https://hawkopen.com/en/faq/accuracy/what-is-apple-mail-privacy-protection
It is a feature of Apple Mail on iPhone, iPad and Mac that loads remote content of emails privately through Apple’s servers, often in advance, and hides the recipient’s IP address. For the recipient it means more privacy; for the sender, an open from Apple Mail no longer shows whether the person read the message.
The recipient switches it on in the Mail settings, under Privacy Protection, with the option to protect Mail activity. Because content is loaded whether or not the message is opened, trackers that count every image request show opens that nobody made, and the network address no longer reveals the reader’s location.
HawkOpen recognises these requests by the way Apple fetches the image and by Apple’s network, gives them the category **privacy proxy** and the rule code R-OPEN-APPLE, and does not classify them as human activity or notify you about them. The protection does not click links, so clicks and replies remain useful signals.
Related questions: [Does Apple Mail Privacy Protection create false opens?](https://hawkopen.com/en/faq/accuracy/apple-mail-privacy-protection-false-opens), [Are open rates still reliable after Apple Mail Privacy Protection?](https://hawkopen.com/en/faq/accuracy/open-rate-after-apple-mpp), [How do I turn on Mail Privacy Protection on iPhone or Mac?](https://hawkopen.com/en/faq/detect-block/protect-mail-activity-iphone)
Checked: 2026-11-11
### Are open rates still reliable after Apple Mail Privacy Protection?
URL: https://hawkopen.com/en/faq/accuracy/open-rate-after-apple-mpp
Not as a raw count. For recipients who use Apple Mail with the protection on, an open no longer shows whether they read the message, and no tool can recover their real opens. Look instead at observed opens and clicks, which HawkOpen counts apart from machine and proxy ones, and at replies, and compare them over time.
HawkOpen separates Apple’s privacy proxy opens (R-OPEN-APPLE) from other opens and counts them as machine or proxy opens, so they do not inflate the observed opens. That removes false opens, but it cannot add the real ones that Apple hides.
Clicks are a better signal but not a clean one: company security filters also click links. HawkOpen rates each click with its own rules and classifies a click as likely human activity only with signs such as a visible browser page on a home or mobile network. Replies, available on the Pro and Business plans, remain the strongest signal.
Related questions: [What is Apple Mail Privacy Protection?](https://hawkopen.com/en/faq/accuracy/what-is-apple-mail-privacy-protection), [Are bot clicks inflating my click rate, and how do I filter scanner clicks?](https://hawkopen.com/en/faq/clicks/bot-clicks-inflate-click-rate), [What is a good email open rate?](https://hawkopen.com/en/faq/accuracy/average-email-open-rate)
Checked: 2026-11-11
### What is a good email open rate?
URL: https://hawkopen.com/en/faq/accuracy/average-email-open-rate
HawkOpen does not publish benchmarks, and any single figure deserves caution: since Apple Mail Privacy Protection, raw open rates are inflated and differ widely by audience and mail program. Compare your own results over time, using observed opens and clicks, which HawkOpen counts apart from machine and proxy ones, and replies.
Published averages mix newsletters and personal emails, different industries and different ways of counting, often including machine opens. For one-to-one business emails, a reply tells you far more than any open rate.
In HawkOpen every open and click has a category, so you can see how many events came from Apple Mail, a provider’s proxy or a scanner, and how many showed no sign of a machine (observed, which does not mean a person). Use the same way of counting when you compare two periods or two versions of a message.
Related questions: [Are open rates still reliable after Apple Mail Privacy Protection?](https://hawkopen.com/en/faq/accuracy/open-rate-after-apple-mpp), [How accurate is email open tracking?](https://hawkopen.com/en/faq/accuracy/how-accurate-is-email-open-tracking)
Checked: 2026-11-11
### Can an email tracker show the recipient’s location?
URL: https://hawkopen.com/en/faq/accuracy/can-email-track-location
Not precisely. A tracker sees the network address that loaded the image, which at best suggests a country, and with Apple Mail or Gmail it is the address of their servers, not of the person. HawkOpen resolves an address at most to a country, never to a city or street.
A VPN, a company network or a mobile operator can also put the address in another region or country. HawkOpen treats the result as the location of the network, not of the recipient, and uses it mainly to judge whether a request is classified as likely human activity or as a machine.
Recipients who want to hide even that can block remote images or use a mail program that loads images through a proxy, such as Apple Mail with Mail Privacy Protection.
Related questions: [Why do opens come from Google’s image proxy, and how do I tell them from real ones?](https://hawkopen.com/en/faq/accuracy/google-image-proxy-opens), [What is Apple Mail Privacy Protection?](https://hawkopen.com/en/faq/accuracy/what-is-apple-mail-privacy-protection), [How do I block email tracking?](https://hawkopen.com/en/faq/detect-block/how-to-block-email-tracking)
Checked: 2026-11-11
### Can I tell if my email was forwarded?
URL: https://hawkopen.com/en/faq/accuracy/can-i-tell-if-email-was-forwarded
Not reliably. A forwarded copy usually carries the same tracking image and links, so when the new reader opens it, the event is recorded under the original recipient. HawkOpen does not report forwarding of ordinary emails.
Opens from new places or programs can hint at another reader, but the same person often reads on a phone, a laptop and an office computer, so such a pattern is no proof. Some mail programs also drop or rewrite images and links when forwarding.
If it matters who reads a message, send it to each person separately: from the HawkOpen dashboard every recipient gets their own copy, and a tracked copy has its own tracker. A copy is tracked only where your company has switched tracking on and the recipient has consented.
Related questions: [Why does one email show many opens?](https://hawkopen.com/en/faq/accuracy/why-one-email-shows-many-opens), [How do I track email opens?](https://hawkopen.com/en/faq/how-works/how-to-track-email-opens)
Checked: 2026-11-12
### Why do I see an open when I look at my own sent email?
URL: https://hawkopen.com/en/faq/accuracy/own-opens-notification
Because your copy in the Sent folder can contain the same tracking image. If your mail program loads it, HawkOpen records an event like any other; it does not recognise that the open was yours.
In Gmail on the web the image is usually fetched through Google’s proxy, so the event gets the category **proxy cache** and never counts towards an alert. In a desktop or phone mail program on your home or office network it can be classified as human activity, and then it can count towards an alert rule, such as several opens in a short time.
To avoid this, do not open your own tracked messages with images shown, or check the time and category of the event. When you test HawkOpen, send to a second address of yours and open it on another device, rather than reading the Sent copy.
Related questions: [Why does my tracker say an email was opened when nobody opened it?](https://hawkopen.com/en/faq/accuracy/why-tracker-says-opened-when-nobody-opened), [Why does one email show many opens?](https://hawkopen.com/en/faq/accuracy/why-one-email-shows-many-opens)
Checked: 2026-11-11
### Can I exclude my own company network or colleagues from tracking?
URL: https://hawkopen.com/en/faq/accuracy#exclude-company-network-from-tracking
You can exclude recipients, not networks: in your settings, list addresses or whole domains (for example your company’s) and countries that are never tracked. HawkOpen has no list of IP addresses to ignore, so your own opens are not filtered out.
An excluded address or domain gets a plain email with no tracking image and no tracked links, so internal emails to colleagues create no events at all.
If you open your own tracked message, from the Sent folder or a copy, it is recorded like any other request. Check the time and category of the event, or test by sending to a second address of yours.
Related questions: [Why do I see an open when I look at my own sent email?](https://hawkopen.com/en/faq/accuracy/own-opens-notification), [Why does one email show many opens?](https://hawkopen.com/en/faq/accuracy/why-one-email-shows-many-opens)
Checked: 2026-11-11
### Can I tell a bounced email from an unopened one?
URL: https://hawkopen.com/en/faq/accuracy#bounce-vs-open-detection
Yes. A bounce is recorded as its own delivery status, separate from opens: a hard bounce shows the message as rejected, while an email that was accepted but never opened simply has no open events.
HawkOpen distinguishes hard bounces (the address does not exist or refuses mail) from soft ones (a temporary problem such as a full mailbox). No open, on the other hand, does not mean nobody read the email: the recipient may block images.
Related questions: [Does HawkOpen confirm that an email was delivered?](https://hawkopen.com/en/faq/accuracy#delivery-status-confirmation), [What happens if the recipient blocks images?](https://hawkopen.com/en/faq/accuracy/what-if-recipient-blocks-images)
Checked: 2026-11-11
### What do “likely”, “possible” and “unknown” mean in a HawkOpen verdict?
URL: https://hawkopen.com/en/faq/accuracy#confidence-levels-and-unknown
Every verdict has a category and a confidence of “likely” or “possible”; there is no “certain”. “Unknown” means no rule explained the event, so HawkOpen classifies it neither as a machine nor as likely human activity.
“Likely” means strong signs point one way, such as Apple’s relay network or several human signals together. “Possible” means weaker signs, for example a mail program on a home network: it may be human activity, but that is not settled.
Use “unknown” and “possible” events as hints only. A reply is the only kind of signal that comes from the recipient’s own action.
Related questions: [What categories can an open or click have?](https://hawkopen.com/en/faq/accuracy#open-signal-categories), [What counts as a likely human open or click, and what should I do with it?](https://hawkopen.com/en/faq/accuracy#likely-human-open-or-click), [Does an open prove that someone read my email?](https://hawkopen.com/en/faq/accuracy/does-an-open-prove-the-email-was-read)
Checked: 2026-11-11
### What is the image at the end of the message used for?
URL: https://hawkopen.com/en/faq/accuracy#end-of-message-image
It shows whether the mail app displayed the whole message. Gmail, for example, clips long emails; if the second image at the very end loads, the message was shown to the end. It never counts as an extra open.
In the message details you see the time the end of the message was first displayed. If it never appears while opens do, the email may have been clipped, so the end, with any link or signature there, was not shown. Keep important links near the top.
Related questions: [Why does one email show many opens?](https://hawkopen.com/en/faq/accuracy/why-one-email-shows-many-opens), [What is an email tracking pixel?](https://hawkopen.com/en/faq/how-works/what-is-an-email-tracking-pixel)
Checked: 2026-11-11
### Does HawkOpen confirm that an email was delivered?
URL: https://hawkopen.com/en/faq/accuracy#delivery-status-confirmation
It confirms what it can see: that the sending server accepted the message, or that it bounced. It does not claim that the email reached the inbox, because the receiving side does not report that.
Each recipient has a status: prepared, accepted by the sending server, or rejected. “Accepted” is not delivery to the inbox: the message can still land in spam or bounce later. A delivery receipt from Outlook has the same limit: it depends on the receiving server.
Opens, clicks and replies come on top, each with a category. A reply is the clearest sign the email arrived and was read.
Related questions: [What is the difference between a delivery receipt, a read receipt and open tracking?](https://hawkopen.com/en/faq/read-receipts/read-receipt-vs-open-tracking), [How can I prove that an email was sent or received?](https://hawkopen.com/en/faq/how-works/how-to-prove-an-email-was-sent-or-received), [Can I tell a bounced email from an unopened one?](https://hawkopen.com/en/faq/accuracy#bounce-vs-open-detection)
Checked: 2026-11-11
### Can I see exactly when the email was opened?
URL: https://hawkopen.com/en/faq/accuracy#exact-time-of-open
Yes: every event in the message timeline has its own date and time, together with its category and rule codes. The time is when the image was requested, which is not always when a person looked at it.
Apple Mail and Gmail may load the image in advance, and scanners act within seconds of delivery, so the first event is often a machine. Look for later events classified as possible or likely human activity.
Related questions: [Why does an open appear seconds after I send the email?](https://hawkopen.com/en/faq/accuracy/why-open-appears-seconds-after-send), [Which time zone are times shown in?](https://hawkopen.com/en/faq/reports#timezones-in-dashboard)
Checked: 2026-11-11
### Can tracking show how long someone read the email?
URL: https://hawkopen.com/en/faq/accuracy#how-long-was-email-read
Not for an email. HawkOpen records when the tracking image was requested, not how long the message stayed open. Time per page is measured only for a PDF shared as a link, once the reader agrees on the page, and file sharing waits for the malware-scanning service, which is not switched on yet.
Several opens of one email can mean the person came back to it, or that a proxy, a scanner or a second device loaded the image. Check the category of each event before reading anything into the count.
Related questions: [Why does one email show many opens?](https://hawkopen.com/en/faq/accuracy/why-one-email-shows-many-opens), [Can I see exactly when the email was opened?](https://hawkopen.com/en/faq/accuracy#exact-time-of-open)
Checked: 2026-11-12
### How many classification rules are there, and what happens to old events when rules change?
URL: https://hawkopen.com/en/faq/accuracy#rules-count-and-versions
More than 40 named rules, and every verdict records the version of the rules that produced it. HawkOpen keeps the signals of each event, so they can be classified again under a newer version; the earlier verdict stays stored next to the new one.
Rules change when mail providers change how they fetch images, for example a new proxy or scanner. A changed threshold always means a new version number, so you can tell which rules a verdict came from. The message details show the newest verdict for each event.
Related questions: [What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?](https://hawkopen.com/en/faq/accuracy#rule-codes-explained), [How accurate is email open tracking?](https://hawkopen.com/en/faq/accuracy/how-accurate-is-email-open-tracking)
Checked: 2026-11-11
### What counts as a likely human open or click, and what should I do with it?
URL: https://hawkopen.com/en/faq/accuracy#likely-human-open-or-click
An event that no rule attributes to a machine and that shows signs of human activity, such as a mail program on a home or office network, or a click with a real, visible browser. It is still an estimate, so treat it as a good moment to follow up, not as proof.
Such an event does not send a notification on its own; on the Pro and Business plans an alert rule, for example several opens in a short time, can tell you about it. A click is usually a stronger signal than an open because a person chose that link.
A good follow-up refers to what the link was about, without saying that you saw the open. If you need a decision, ask a clear question so a reply is easy.
Related questions: [What do “likely”, “possible” and “unknown” mean in a HawkOpen verdict?](https://hawkopen.com/en/faq/accuracy#confidence-levels-and-unknown), [What is the difference between an open and a click?](https://hawkopen.com/en/faq/accuracy#difference-between-open-and-click), [Does an open prove that someone read my email?](https://hawkopen.com/en/faq/accuracy/does-an-open-prove-the-email-was-read)
Checked: 2026-11-11
### Does HawkOpen recognise Microsoft and Yahoo image proxies?
URL: https://hawkopen.com/en/faq/accuracy#microsoft-and-yahoo-proxy-detection
Yes. Requests from Microsoft’s and Yahoo’s image proxies get the category **proxy cache**, with the rule codes R-OPEN-MSPROXY and R-OPEN-YAHOO, and do not trigger notifications.
Such a proxy fetches the image on the reader’s behalf and hides their network. The request may follow a real open, but it may also be the provider caching the image, so HawkOpen does not classify it as human activity. Gmail’s proxy is handled the same way.
Related questions: [Why do opens come from Google’s image proxy, and how do I tell them from real ones?](https://hawkopen.com/en/faq/accuracy/google-image-proxy-opens), [What categories can an open or click have?](https://hawkopen.com/en/faq/accuracy#open-signal-categories)
Checked: 2026-11-11
### Does Apple Mail Privacy Protection pre-fetch links or only images?
URL: https://hawkopen.com/en/faq/accuracy#mpp-prefetch-links-or-images
Apple’s feature loads remote images, including tracking images, through Apple’s servers; HawkOpen marks those loads with R-OPEN-APPLE. Clicks are judged separately by the click rules, so an Apple image load never turns into a click.
If clicks arrive within seconds of delivery or several at once, they usually come from a company security filter, not from Apple; HawkOpen marks those as a security scanner.
Related questions: [Does Apple Mail Privacy Protection create false opens?](https://hawkopen.com/en/faq/accuracy/apple-mail-privacy-protection-false-opens), [Why was my link clicked seconds after I sent the email?](https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending)
Checked: 2026-11-11
### What categories can an open or click have?
URL: https://hawkopen.com/en/faq/accuracy#open-signal-categories
Seven: Apple Mail Privacy Protection, prefetch (such as Gmail’s), link preview, security scanner, proxy cache, human, and unknown. Each comes with a confidence and the rule codes behind it.
The first five are machines: they stay in the list but never fire an alert, and the numbers and reports count them apart, as machine or proxy opens and scanner clicks. **Human** means the event is classified as human activity, at most “likely”. **Unknown** means no rule explained the event. In the numbers an event with no sign of a machine counts as observed, which does not mean that a person was there.
Related questions: [What do “likely”, “possible” and “unknown” mean in a HawkOpen verdict?](https://hawkopen.com/en/faq/accuracy#confidence-levels-and-unknown), [What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?](https://hawkopen.com/en/faq/accuracy#rule-codes-explained)
Checked: 2026-11-11
### Can I manually correct a classification?
URL: https://hawkopen.com/en/faq/accuracy#override-a-classification
No. HawkOpen has no manual override: every verdict comes from the rules, and the same signals always give the same result, with the rule codes shown so you can judge it yourself.
If the rules change, stored signals can be classified again under the new version. To keep internal emails out of tracking altogether, exclude your company’s domain in the settings.
Related questions: [How many classification rules are there, and what happens to old events when rules change?](https://hawkopen.com/en/faq/accuracy#rules-count-and-versions), [Can I exclude my own company network or colleagues from tracking?](https://hawkopen.com/en/faq/accuracy#exclude-company-network-from-tracking)
Checked: 2026-11-11
### What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?
URL: https://hawkopen.com/en/faq/accuracy#rule-codes-explained
Each code names one rule that matched the event: R-OPEN-… for opens and R-CLK-… for clicks. For example, R-OPEN-APPLE is Apple’s relay, R-CLK-BURST is three or more links clicked within two seconds, R-CLK-HEADLESS a browser with no window, and R-CLK-JS a real, visible browser.
There are more than 40 such rules. Most add points towards a machine; a few, like R-OPEN-CLIENT and R-CLK-JS, point towards human activity. The category comes from all the rules that matched, so read the codes when a verdict surprises you.
Related questions: [What categories can an open or click have?](https://hawkopen.com/en/faq/accuracy#open-signal-categories), [How many classification rules are there, and what happens to old events when rules change?](https://hawkopen.com/en/faq/accuracy#rules-count-and-versions), [How does HawkOpen detect headless browsers and bots?](https://hawkopen.com/en/faq/clicks#headless-browser-detection)
Checked: 2026-11-11
### How are opens and clicks from VPN, cloud or hosting networks treated?
URL: https://hawkopen.com/en/faq/accuracy#vpn-cloud-and-hosting-networks
As likely machines. A request from a cloud or hosting network counts towards a scanner (rules such as R-OPEN-CLOUD and R-CLK-HOSTING), and a click from such a network is never classified as likely human activity, whatever other signs it shows.
Activity of a real person on a VPN that runs in a data centre will therefore not be classified as human activity. This is deliberate: it is better to miss human activity than to classify a scanner as human. A reply still counts.
Related questions: [Why was my link clicked seconds after I sent the email?](https://hawkopen.com/en/faq/accuracy/link-clicked-seconds-after-sending), [What are rule codes such as R-OPEN-APPLE and R-CLK-BURST?](https://hawkopen.com/en/faq/accuracy#rule-codes-explained)
Checked: 2026-11-11
### Why are my email open rates going down?
URL: https://hawkopen.com/en/faq/accuracy#why-open-rates-going-down
Often because of measurement rather than readers: more people and companies block remote images, and tools that count machine and proxy opens apart from observed ones, as HawkOpen does, show fewer opens than tools that count every image load.
Compare periods with the same way of counting, and watch clicks and replies alongside opens. If bounces rise at the same time, check delivery as well.
Related questions: [What is a good email open rate?](https://hawkopen.com/en/faq/accuracy/average-email-open-rate), [Are open rates still reliable after Apple Mail Privacy Protection?](https://hawkopen.com/en/faq/accuracy/open-rate-after-apple-mpp), [What happens if the recipient blocks images?](https://hawkopen.com/en/faq/accuracy/what-if-recipient-blocks-images)
Checked: 2026-11-11
### What is the difference between an open and a click?
URL: https://hawkopen.com/en/faq/accuracy#difference-between-open-and-click
An open is a request for the invisible tracking image; a click is a request for a tracked link. Each gets its own category, and a click usually tells you more because someone, or something, chose a link.
Opens disappear when images are blocked, and privacy proxies create opens without a person. Clicks still work with images blocked, but company security filters click links too. Read both together, and the category of each.
Related questions: [What counts as a likely human open or click, and what should I do with it?](https://hawkopen.com/en/faq/accuracy#likely-human-open-or-click), [What happens if the recipient blocks images?](https://hawkopen.com/en/faq/accuracy/what-if-recipient-blocks-images), [How do I track link clicks in my emails?](https://hawkopen.com/en/faq/clicks/how-to-track-email-clicks)
Checked: 2026-11-11