Fake email opens: how Pedibee separates Apple Mail, scanners and bots from real readers

Why do fake email opens happen?

Email opens and clicks are only an image download and a link request, so any software that fetches the image or follows the link looks like a reader unless the sender filters it.

Open tracking works by adding a tiny image to the email. When the image loads, the sender records an open. Click tracking sends each link through a redirect on the sender's side, which records the click and then forwards to the real page. Neither can see a pair of eyes. A mail app that loads images on its own, or a security system that follows links to check them, produces the same requests a reader would.

So an open is weaker evidence than it looks. A Gmail API answer that accepts your message isn't proof the email was sent (our guide to Gmail's "User-rate limit exceeded" error explains why), and in the same way an open isn't proof the email was read. Three kinds of software are behind this: Apple Mail's privacy feature, security scanners, and mail providers' image proxies. The first two need filtering. The third mostly doesn't.

What does Apple Mail Privacy Protection do to opens?

Apple Mail Privacy Protection (MPP) makes opens from Apple Mail readers who have it turned on close to meaningless, because Apple Mail downloads tracking images in the background whether or not the email is read. Apple's support guide says Mail Privacy Protection "prevents senders from seeing if you've opened the email message they sent you" and hides the reader's IP address.

Apple's privacy page, which calls the feature Protect Mail Activity, explains how. The feature "downloads remote content in the background by default", "regardless of whether you engage with the email", and routes it through two separate relays. Remote content includes your tracking image. So the image loads when the email arrives on the device, read or not, and the open you record says the email reached an Apple Mail inbox. It doesn't say anyone looked.

The same page covers Mail on iPhone, iPad, Mac and Apple Vision Pro, and Mail on iCloud.com, so a reader on any of them can trigger these opens. In Settings the switch is called Protect Mail Activity.

Clicks are different. Apple's guide states that Mail Privacy Protection "does not extend to links or email attachments". A click from an Apple Mail reader is still a person following a link, unless a scanner made it first.

Apple doesn't publish the addresses its relays use or when they fetch. What we do know is that the whole 17.0.0.0/8 block is registered to Apple Inc. in ARIN's records. Treating opens from that block as Mail Privacy Protection is Pedibee's rule, based on that registration, not something Apple documents.

Why do security scanners click every link?

Security scanners such as Microsoft Defender for Office 365 Safe Links follow the links in incoming email to check them before a person can click, and each of those visits reaches the sender's click tracker.

Microsoft documents this for Safe Links, which "provides URL scanning and rewriting of inbound email messages during mail flow". Microsoft adds: "URLs are scanned prior to message delivery, regardless of whether the URLs are rewritten or not." Other security gateways check links too.

What this looks like in your stats:

• Clicks within seconds of sending, before any person could have read the email.
• Several different links clicked within a few seconds of each other.

Many scanners and other bots don't announce themselves, so the user agent alone misses them. Timing catches what it doesn't.

That includes the unsubscribe link. In Pedibee, opening that link only shows a page with a button. Nothing happens until a person presses it or uses their mail app's own unsubscribe option, so a scanner that follows every link never opts anyone out. The help centre's unsubscribes guide has the details.

Are Gmail and Yahoo opens real?

Pedibee counts opens that arrive through Gmail's and Yahoo's image proxies as real opens. These opens reach the tracker from the providers' proxies, which Pedibee recognises by their user agents (GoogleImageProxy, YahooMailProxy), rather than from the reader's device. In our understanding those proxies fetch the image when someone opens the email, not when it arrives.

Google's help is brief on this. Its page on images says "Sometimes, senders may know whether you've opened an email that has an image." It doesn't describe when the proxy fetches, so treat Pedibee's rule as our judgement, not a Google statement.

Two cases can still produce opens that aren't your contact:

• You open your own copy of the email in Gmail's Sent folder. In our understanding the image loads there too.
• The contact forwards the email, and someone else opens it.

What rules does Pedibee use to spot automatic opens and clicks?

Pedibee uses five rules to mark a hit as automatic, plus a 10-second wait before clicks count. Each hit is judged on its own as it arrives. When the email's counts are settled, clicks are judged together for bursts, and opens near a burst are marked too.

The 5 second window is short on purpose. People often open their own test email straight away, and a longer window would throw away real opens.

A few details about how this runs in Pedibee:

• Hits are recorded as they arrive. The API records each open and click when the request comes in, not through a background worker, so tracking keeps working if the worker is behind. The IP address is used only to classify the hit. It isn't stored.
• You can see every verdict. Automatic hits show on the email in the contact's activity as chips such as Opened too early · not counted, Clicked by a scanner · not counted or Apple Mail opened it · not counted.
• Reports use real hits only. Campaign and sequence link reports list real clicks and say how many automatic hits were left out. Automation branches on "opened" or "clicked" read the same filtered counts, so an Apple prefetch or a scanner burst doesn't send someone down the "opened" path.
• Long emails get the pixel first. Gmail shows "[Message clipped]" on long emails and hides the rest behind a link, so a tracking image at the end might never load. The limit is widely reported as about 102 KB of HTML, but we haven't found it on a Google page. When an email is over 90 KB, our own margin, Pedibee puts the pixel at the start of the body instead of the end.

Setup is in the help centre's email tracking guide, and see where open and click tracking fits in the product.

Example: one email's opens and clicks, filtered

Say one campaign email goes to a person at a company whose mail passes through a security gateway. They read mail in Apple Mail on an iPhone with Mail Privacy Protection on, and on a desktop. The email is sent at 09:00:00 and has three links.

Result: 1 open and 1 click counted, 5 automatic hits kept. Without filtering, the same email would show 3 opens and 4 clicks, five of those hits in the first five minutes.

Notice the clicks at 09:00:06 and 09:00:07. Each is more than 5 seconds after sending, so the too-fast rule alone would let them through. The burst rule catches them because they came within seconds of other links being clicked. That is why clicks wait 10 seconds before they count.

What should I trust instead of open rate?

Trust replies first, then filtered clicks, then opens as a weak hint that the email arrived and may have been seen.

1. Replies. A reply is a person. Nothing else on this list is certain.
2. Clicks, after filtering. A click that passes Pedibee's scanner, timing and burst filters is usually a person, and Mail Privacy Protection doesn't hide clicks.
3. Opens. Useful in aggregate, for comparing subject lines on the same audience, or for noticing that a whole domain shows no opens at all. Weak for any single person.

Be clear about one limit: Pedibee has no reply detection. It sends through Gmail with send-only access to your Gmail and can't read your inbox, so it doesn't see replies. When someone replies, you mark the contact Replied to stop the sequence. Pedibee checks every person before each step, so they get no further steps, and campaigns set to skip people who replied leave them out.

If opens don't help you, you can turn open tracking off for a campaign, a sequence or one email, or as the workspace default. We make no claim that this changes delivery. For delivery itself, look at what the mailbox providers report, such as Gmail's spam rate and the Postmaster Tools compliance status.

Why track through your own domain instead of a shared one?

Tracking through your own subdomain means your links carry your company's domain, and their reputation depends on your sending alone, not on other senders sharing a tracking domain. Pedibee only tracks through each workspace's own subdomain, such as track.yourcompany.com, set up with one CNAME record. Until a workspace sets one up, its emails go out untracked.

The reasoning:

• The link matches the sender. A reader who hovers over a link sees your company's domain, not a stranger's.
• Reputation isn't pooled. A shared tracking domain is used by everyone on it. If one of them sends spam, the links in your emails carry the same domain.

Some vendors say a shared tracking domain hurts inbox placement. We haven't seen a study that measures it, so treat that as a vendor claim, not a finding. We make no claim that a custom domain lifts placement by any amount.

With click tracking on, Pedibee tracks every web link through that domain, including web addresses written as plain text. It turns those into links first, because mail apps make them clickable anyway and those clicks would otherwise go untracked.

What can these rules not catch?

Pedibee's filters for automatic opens and clicks are estimates, not proof. Four known gaps:

• A patient scanner looks like a person. One that waits more than 5 seconds and follows a single link passes every rule.
• A fast person isn't counted. Someone who opens or clicks within 5 seconds of sending, outside Gmail and Yahoo's proxies, is marked too fast. Your own test email is the usual case.
• Apple Mail readers lose their opens. When a person on Apple Mail does read the email, that open still comes from Apple's network and isn't counted. Their clicks still count.
• Not every Apple prefetch may come from Apple's addresses. Apple says the content passes through two relays "operated by different entities", and doesn't say which. A prefetch that arrives from outside 17.0.0.0/8 is only caught if its user agent or timing gives it away.

So filtered opens and clicks are better numbers than raw ones, not the truth. Replies remain the signal to act on.

Sources

• Apple Support, Use Mail Privacy Protection on iPhone. Vendor documentation, read 13 October 2026.
• Apple, Mail Privacy Protection & Privacy. Vendor documentation, read 13 October 2026.
• Microsoft Learn, Safe Links in Microsoft Defender for Office 365. Vendor documentation, updated 22 May 2026.
• Gmail Help, Turn images on or off in Gmail. Google documentation, read 13 October 2026.
• ARIN, registration record for 17.0.0.0/8. Registry record showing Apple Inc. as the registrant.

Frequently asked questions

Why did my email show an open seconds after sending?

Almost always it's software, not a person. The receiving mail server or a security check loads the email as it arrives. In Pedibee, any open or click within 5 seconds of sending is marked automatic and isn't counted. The one exception is an open through Gmail's or Yahoo's image proxy, which Pedibee counts, because in our understanding those proxies fetch only when someone opens the email.

Why is my open rate close to 100%?

Usually because software opened the emails, not people. Apple Mail with Mail Privacy Protection loads every email's images in the background, and some company mail systems load images and follow links as mail arrives. If much of your audience uses Apple Mail or sits behind a security gateway, raw opens can come close to every email sent. Filter out automatic opens, or judge by clicks and replies instead.

Does Apple Mail Privacy Protection make open rates useless?

For people who read on Apple Mail with the protection on, an open tells you very little. Apple says it downloads remote content in the background whether or not you engage with the email. Pedibee marks opens from Apple's network as automatic and leaves them out of the count. Apple also says the protection doesn't extend to links, so clicks from those readers still count.

Why were all the links in my email clicked at once?

That's a security scanner checking every link before or as the email is delivered. A person rarely clicks several different links within seconds. Pedibee treats different links of one email clicked within 5 seconds of each other as a burst and marks them automatic. Clicks wait 10 seconds before they count, so a scanner's whole burst is judged together.

Are Gmail opens real?

Pedibee counts opens through Gmail's image proxy as real, because in our understanding the proxy loads images when someone opens the email. That is our judgement, not a Google statement. Some opens still aren't your contact: in our understanding, opening your own copy in Gmail's Sent folder can register an open, and so can the contact forwarding the email to someone else.