# Open and click tracking

Open tracking is far less reliable than the industry pretends. Apple Mail Privacy Protection pre-fetches every remote image through Apple's proxy shortly after delivery, whether or not a human ever looked. In many audiences roughly half of consumer opens are machine opens. So we show three numbers, never one.

| Number | What it is |
|---|---|
| Total opens | Every pixel fetch, including proxies and scanners |
| Human opens (estimated) | Non-proxy fetches that pass our timing and ASN heuristics |
| Machine / proxy opens | Apple MPP, Gmail's image proxy, corporate security scanners |

Geography and device breakdowns are computed from non-proxy events only, and every geo view carries a caption saying how many of the opens could actually be located. Reputation scoring weighs clicks far more heavily than opens for exactly this reason.

## Link rewriting and the open-redirect problem

A tracked link becomes a compact signed token — version, workspace, message, link and expiry — validated by HMAC at the edge with no database read, which is what makes a sub-25 ms redirect possible. The destination is resolved from the link id against the campaign's own link table, never from a URL in the query string. An open redirect on a mail domain is a phishing gift and a fast route to a blacklist.

- Never rewritten: mailto:, tel:, anchors, the unsubscribe link, and anything marked data-mh-no-track.
- Tokens stop resolving after 12 months by default.
- Customers who add the track. CNAME get their own domain in the link, which improves both click-through and deliverability.

> **Security-critical messages are never tracked** — Password resets, one-time codes, login alerts and payment receipts have open tracking hard-disabled. There is no toggle. A tracking pixel in a password-reset email is a privacy liability for you and a deliverability problem for us.