How Email Tracking Pixels and Tracked Links Work
An email can report activity without running JavaScript. A tiny remote image can create a web request when the message is displayed, and a link can pass through a redirect service before reaching its visible destination. Both techniques are common in legitimate newsletters, security notifications, and product analytics. They are also useful to spammers and phishers.
Understanding the network request is more useful than trying to spot a literal one-pixel image.
What a tracking pixel really is
A tracking pixel is usually a remote image URL embedded in HTML email. It may be a transparent 1×1 image, but it can also be a logo, banner, or any other image whose URL is unique to the recipient.
Simplified HTML might look like this:
<img src="https://sender.example/open/recipient-token.gif" width="1" height="1">When an email client requests that URL, the sender’s server receives an ordinary HTTP request. Depending on the client and privacy protections, the request can reveal that the resource was fetched, the time, a network address or proxy, basic request headers, and the unique token in the URL.
The sender usually cannot prove that a human carefully read the message. Images may be prefetched, proxied, cached, blocked, or loaded automatically in a preview. “Opened” is therefore an interpretation of a network event, not a reliable statement about human attention.
Why modern privacy features change the signal
Some email clients proxy or prefetch remote images. Apple explains that Mail Privacy Protection hides the user’s IP address and prevents senders from accurately seeing whether the recipient opened a message.
This does not mean remote content has stopped existing. It means the sender may observe a request from a privacy relay, at a different time, or with less useful location information. Other clients may block images by default, ask first, or load them directly.
| Client behavior | What the sender may observe | What cannot be concluded safely |
|---|---|---|
| Direct image load | Fetch time and network metadata | That the full message was read |
| Image proxy | Proxy fetch and unique image token | The recipient’s exact IP or location |
| Prefetch | An early automated request | That a person opened the message then |
| Images blocked | No image request | That the message was never read |
Tracked links work differently
A tracked link contains a unique identifier or first visits a redirect domain. The redirect records the click and then sends the browser to the destination.
email -> tracking.example/click/unique-token -> destination.example/pageA click is usually a stronger interaction signal than an image load because it requires navigation. However, security scanners may also visit links automatically. The tracking service can record time, IP or proxy information, browser headers, and the token connecting the click to a particular message.
Links can also include the identifier directly in a query string. Even when the destination is legitimate, the URL may reveal a campaign, recipient record, or account action.
Verification links are intentionally unique
Not every unique link is marketing tracking. Password-reset and verification links need a high-entropy token so the website can recognize a specific, authorized action. That token is a credential for a limited purpose and time.
Treat it like a password:
- do not post a screenshot containing the full URL;
- do not paste it into public link scanners unless you understand the consequence;
- verify the destination domain before opening it;
- use it only in the account flow you initiated;
- request a new link if you accidentally expose it.
How TempMailer displays messages
TempMailer opens messages in text mode by default. The optional HTML view runs in a sandboxed frame with remote images, scripts, forms, media, and external frames blocked by Content Security Policy. A no-referrer policy also prevents the mailbox URL from being sent as an HTTP referrer.
This reduces automatic sender-controlled requests while reading. It does not make a clicked external link safe. Once you deliberately navigate to another website, that website receives a new browser request under its own policies.
Plain-text mode is often enough for a verification code. If a message only provides a button, inspect the visible domain carefully before using the HTML view or opening the link.
A safer reading workflow
- Check the sender context. Did you request this message, at this time, from this service?
- Read the subject and text first. Codes rarely require remote images.
- Inspect the destination. Watch for misspellings, unrelated redirect domains, and unexpected URL shorteners.
- Prefer manual navigation for sensitive accounts. Open the known website or app and continue there instead of clicking an unsolicited link.
- Do not download unexpected files. A temporary inbox does not disinfect attachments.
- Close the relationship when finished. Do not reuse a short-lived inbox for a valuable account.
CISA recommends using a separate, known contact path when a message seems suspicious instead of trusting the phone number or link inside it.
For email developers
Open metrics are noisy. Do not treat a pixel request as proof that a user saw a legal notice, completed onboarding, or consented to anything. Use explicit in-product state for important events.
Keep tracking proportional and disclosed. Avoid placing personal information directly in URLs; use random, expiring identifiers. Secure redirect endpoints against open redirects, validate destinations, and avoid leaking tokens into logs and third-party analytics.
Transactional messages should remain useful with remote images blocked. Put essential codes and instructions in real text, provide a recognizable destination domain, and include an accessible alternative to image-only buttons.
Bottom line
Tracking pixels observe remote-resource requests; tracked links observe navigation through a unique URL or redirect. Privacy proxies and scanners make both signals imperfect. Reading text first, blocking remote content, checking destination domains, and treating verification URLs as credentials gives you more control without assuming every tracked message is malicious.