Many emails tell the sender when and where you read them. They do it with a tracking pixel. This post explains how that works, what SipherMail does about it, and where our protection stops.
What a tracking pixel is#
A tracking pixel is a tiny image, often one pixel by one pixel, placed in the HTML of an email. It is usually invisible. When your mail app displays the message, it fetches the image from the sender’s server. That request tells the sender:
- That you opened the message, and when.
- Your IP address, which can hint at your location.
- Details about your device and mail app, from the request headers.
- How many times you opened it.
The image URL is often unique to you, so the sender knows which recipient it was. Some pixels are not even tiny: a normal-looking image can be a tracker if its address carries an identifier.
None of this needs you to click anything. Opening the message is enough.
What SipherMail removes#
SipherMail removes known tracking pixels from incoming mail. This applies to all messages, including ones from senders you trust. Removal happens by pattern, and the pixel is taken out of the message so it never loads. We look for:
- Very small images, around three pixels or less in width or height.
- Hidden images, hidden with inline styling such as display none, hidden visibility or zero opacity.
- Addresses that match known tracking patterns, such as common open-tracking paths and the domains of well-known email marketing and tracking services.
The list of patterns is ours to maintain, and pattern matching is imperfect. A tracker that does not look like any pattern we know can get through.
What the image proxy does#
Remote images that are not removed load through SipherMail’s image proxy. Instead of your device contacting the sender’s server, our server fetches the image and passes it on.
That changes what the sender sees. They see a request from our servers, not your IP address and not your device details. Proxied URLs are signed and expire, so the proxy is not an open relay for anyone to use. Images that are inline in the message, or that belong to SipherMail itself, are not proxied.
The limits#
We would rather you know these than assume more protection than exists.
- We do not stop all tracking. Pattern-based removal misses trackers it does not recognise.
- The sender can still learn that an image was fetched. If an unrecognised tracker is loaded through the proxy, the sender may still see a request, and may be able to tell that the message was opened, though not your IP address or device.
- Links are separate. A link you click can carry a tracking identifier. Removing pixels does not rewrite links, and the site you visit will see you.
- Blocking remote images is a setting, and it is off by default. With the block remote images setting off, images in your mail load through the proxy. If you turn it on, SipherMail does not load remote images at all. That is the stronger option, and you can trust individual senders when you want their images.
- It only covers HTML mail you read in SipherMail. If you read the same mail in another app over IMAP, that app decides what loads.
- It does not change what the sender knows already. They know the address they sent to, and they know whether the message bounced.
What we recommend#
If you want the most protection, turn on blocking of remote images and allow images from senders you trust. Messages will look plainer, but nothing in them will contact the sender.
If you prefer to see images, leave blocking off. You still get pixel removal and the proxy, which hides your IP address and device from the sender.
Either way, be careful with links in marketing mail. A link is a stronger signal to a sender than a pixel, because it shows you chose to click.
Why we do it this way#
Removing known pixels for everyone, with no setting to find, protects people who would never think to look. Proxying means that even when we do load an image, the sender learns less. Making full blocking a setting reflects a trade-off: blocked images break many newsletters and receipts, and we did not want to ship a default that made normal mail look broken.
We think a modest, accurate protection beats a bold claim that fails in practice.
You can read the setup details in image privacy.