Log in Coming soon
Start for €1 + VAT Coming soon
Each request for the tracking image is recorded as a separate event. A proxy, a scanner, the recipient opening the message again on a phone and a computer, or other people reading a forwarded copy all add events, and HawkOpen lists each one with its time and category.
Checked:
A burst of opens within seconds of delivery usually comes from machines. Opens spread over hours or days, from a mail program on a home or mobile network, are more likely a person coming back to the message. Your own views of the message in your Sent folder can also add events.
HawkOpen does not merge these into one number. Look at the category of each event: machine events stay in the list but do not trigger notifications.
Yes. Apple Mail can download the tracking image through Apple’s servers without the person opening the email. HawkOpen labels such requests as a privacy proxy instead of classifying them as likely human activity.
Most likely a security scanner did it. Many company mail systems open the links in an incoming email to check them before the person sees the message. HawkOpen counts these as signs of a scanner, never classifies them as likely human activity on that basis, and lists the rule codes behind the verdict.
No. An open means that the tracking image was requested. The request can come from a person, a privacy proxy, a mail provider’s image cache or a scanner, and HawkOpen never presents it as proof of reading.
It accurately records that a tracking image was requested, but that is not the same as a person reading. It overcounts when Apple Mail, a mail provider’s proxy or a scanner loads the image, and undercounts when images are blocked, so HawkOpen labels each request instead of counting every one as an open.
Usually a machine loaded the image: Gmail’s scanner or prefetching, Apple Mail Privacy Protection or a company security filter. HawkOpen has rules for these, such as R-OPEN-GOOGLE-SCAN, R-OPEN-GMAIL-PREFETCH, R-OPEN-APPLE and R-OPEN-FAST, and a fast open alone is never classified as likely human activity.
Gmail does not let the reader’s device fetch images directly: Google’s servers fetch them and pass them on, so you see Google’s network instead of the reader’s. HawkOpen marks such requests as proxy cache (R-OPEN-GOOGLE) and marks Gmail’s prefetching and scanning with separate rules.
Yes, if the preview shows images: the mail program then loads the tracking image just as when the message is opened, and HawkOpen cannot tell a glance in a preview pane from careful reading. A one-line text preview in the message list, without images, records nothing.
Then the tracking image is not loaded and no open is recorded, even if the person reads every word. Clicks on tracked links are still recorded, and so are replies on the Pro and Business plans, so a click without an open usually means images were blocked.
It is a feature of Apple Mail on iPhone, iPad and Mac that loads remote content of emails privately through Apple’s servers, often in advance, and hides the recipient’s IP address. For the recipient it means more privacy; for the sender, an open from Apple Mail no longer shows whether the person read the message.
Not as a raw count. For recipients who use Apple Mail with the protection on, an open no longer shows whether they read the message, and no tool can recover their real opens. Look instead at observed opens and clicks, which HawkOpen counts apart from machine and proxy ones, and at replies, and compare them over time.
HawkOpen does not publish benchmarks, and any single figure deserves caution: since Apple Mail Privacy Protection, raw open rates are inflated and differ widely by audience and mail program. Compare your own results over time, using observed opens and clicks, which HawkOpen counts apart from machine and proxy ones, and replies.
Not precisely. A tracker sees the network address that loaded the image, which at best suggests a country, and with Apple Mail or Gmail it is the address of their servers, not of the person. HawkOpen resolves an address at most to a country, never to a city or street.
You can exclude recipients, not networks: in your settings, list addresses or whole domains (for example your company’s) and countries that are never tracked. HawkOpen has no list of IP addresses to ignore, so your own opens are not filtered out.
Yes. A bounce is recorded as its own delivery status, separate from opens: a hard bounce shows the message as rejected, while an email that was accepted but never opened simply has no open events.
Every verdict has a category and a confidence of “likely” or “possible”; there is no “certain”. “Unknown” means no rule explained the event, so HawkOpen classifies it neither as a machine nor as likely human activity.
It shows whether the mail app displayed the whole message. Gmail, for example, clips long emails; if the second image at the very end loads, the message was shown to the end. It never counts as an extra open.
It confirms what it can see: that the sending server accepted the message, or that it bounced. It does not claim that the email reached the inbox, because the receiving side does not report that.
Yes: every event in the message timeline has its own date and time, together with its category and rule codes. The time is when the image was requested, which is not always when a person looked at it.
Not for an email. HawkOpen records when the tracking image was requested, not how long the message stayed open. Time per page is measured only for a PDF shared as a link, once the reader agrees on the page, and file sharing waits for the malware-scanning service, which is not switched on yet.
More than 40 named rules, and every verdict records the version of the rules that produced it. HawkOpen keeps the signals of each event, so they can be classified again under a newer version; the earlier verdict stays stored next to the new one.
An event that no rule attributes to a machine and that shows signs of human activity, such as a mail program on a home or office network, or a click with a real, visible browser. It is still an estimate, so treat it as a good moment to follow up, not as proof.
Yes. Requests from Microsoft’s and Yahoo’s image proxies get the category proxy cache, with the rule codes R-OPEN-MSPROXY and R-OPEN-YAHOO, and do not trigger notifications.
Apple’s feature loads remote images, including tracking images, through Apple’s servers; HawkOpen marks those loads with R-OPEN-APPLE. Clicks are judged separately by the click rules, so an Apple image load never turns into a click.
Seven: Apple Mail Privacy Protection, prefetch (such as Gmail’s), link preview, security scanner, proxy cache, human, and unknown. Each comes with a confidence and the rule codes behind it.
No. HawkOpen has no manual override: every verdict comes from the rules, and the same signals always give the same result, with the rule codes shown so you can judge it yourself.
Each code names one rule that matched the event: R-OPEN-… for opens and R-CLK-… for clicks. For example, R-OPEN-APPLE is Apple’s relay, R-CLK-BURST is three or more links clicked within two seconds, R-CLK-HEADLESS a browser with no window, and R-CLK-JS a real, visible browser.
As likely machines. A request from a cloud or hosting network counts towards a scanner (rules such as R-OPEN-CLOUD and R-CLK-HOSTING), and a click from such a network is never classified as likely human activity, whatever other signs it shows.
Often because of measurement rather than readers: more people and companies block remote images, and tools that count machine and proxy opens apart from observed ones, as HawkOpen does, show fewer opens than tools that count every image load.
An open is a request for the invisible tracking image; a click is a request for a tracked link. Each gets its own category, and a click usually tells you more because someone, or something, chose a link.