How Gmail open tracking actually works (and where it lies)

In Gmail, an "open" is recorded when Google's image proxy fetches a tracking pixel on the recipient's behalf. That usually means a real person opened the message. But Gmail's security scan, other bots and Apple Mail Privacy Protection can also fetch the pixel, and cached images can hide repeat opens. A good tracker filters those cases, and clicks remain the more reliable signal.

Every "open rate" you've ever seen is the output of half a dozen heuristics fighting over what counts as a real human glance at an inbox. This post explains what we actually do, and where the model leaks.

The naive version

You drop a 1×1 transparent PNG into the bottom of an HTML email. The image src points to a URL on your server. When the recipient's mail client renders the message, it fetches the image. You record the fetch as an "open."

That works for about thirty seconds, until you remember Gmail exists.

Gmail's two fetchers

Gmail does not fetch images from the recipient's IP. Two different Google fetchers can request your pixel, and telling them apart is most of the job.

The image proxy. When the recipient opens the message, Gmail fetches the image from Google's servers (user-agent GoogleImageProxy) and rewrites the src to point at googleusercontent.com. Google introduced this proxy in 2013, when Gmail started showing images automatically (Gmail blog). This is great for the user, because no third party sees their IP address. It is also a real open: the proxy fetches when a human opens the email, not before.

The prefetch bot. Separately, Gmail runs a security scan that fetches images within seconds of delivery, whether or not anyone ever opens the message. It carries a distinctive fingerprint (an ancient Chrome build and an impossible Edge version in the same user-agent), so it can be recognized and ignored.

The proxy causes two more problems for naive trackers:

1. Every Gmail recipient looks the same: same IP range, same user-agent. That includes you, when you open your own sent message.
2. The proxy caches images. Serve a cacheable pixel and repeat opens never reach your server again.

Count every fetch and your open rate is wrong in both directions: inflated by the prefetch bot and your own views, and deflated by cached repeat opens.

What we do at Maildriply

Four rules:

1. Sign the pixel token. Each pixel URL carries a token: a small JSON payload of opaque database IDs plus an HMAC-SHA256 signature. It is verified in constant time, and a token whose IDs don't match each other in the database is dropped. No email address or other personal data is in the URL.
2. Classify the fetcher. The Gmail prefetch bot is never counted. Gmail's image proxy is counted as a real open. Other suspect fetches (generic bots, prefetch hints, Apple Mail Privacy Protection, non-Gmail proxies) don't count if they arrive within 20 seconds of sending.
3. Ignore your own views. Because your view of the sent message arrives through the same proxy as the recipient's, the Chrome extension tells the server when you open the thread, and those fetches are logged but not counted.
4. Make the pixel uncacheable, then deduplicate. The pixel is served with no-store headers and a random ETag so every open reaches us. Opens from the same recipient count at most once per short window (about a minute), and only the first open is marked unique.

Every fetch that doesn't count is still logged with the reason, so the numbers can be audited. The result is an open rate that trends correctly between campaigns even though no individual open is provably real.

When the model breaks

Several edge cases still bite us:

• Apple Mail Privacy Protection downloads remote content in the background when a message arrives, and hides the recipient's IP (Apple). Early MPP fetches are flagged and not counted, but one that arrives after the 20-second window looks exactly like a real open. Our Apple MPP guide covers what that does to your numbers.
• Image blockers mean some real opens never reach us at all. Click rate is the safer indicator of intent.
• Outlook, Yahoo and Zoho fetch and cache images at delivery. We see that first fetch, but repeat opens are served from their cache and never reach us.
• Your own views from elsewhere. Opening your sent message in the Gmail mobile app, or on a computer without the extension, can't be told apart from the recipient and will count as an open.

If these edge cases show up as "opened" alerts on your phone or desktop, our guide to Gmail open notifications explains how to read them, including what repeated opens usually mean. For how these rules show up in the dashboard, see reading the analytics dashboard. To set tracking up yourself, start with email tracking in Gmail.