The spam filter's view of a tracked email

You want to know when someone reads your email, and you have read that the invisible image which makes that possible is what spam filters hunt for. It is worth settling before you install anything. A tracker adds two things to your message and they carry very different risk: the invisible image is the cheap one, and the rewritten link is the part filters name in writing. If you send a few dozen one to one emails a day from your own Gmail, neither is what stands between you and the inbox.

What a tracker actually adds

Every open tracker works the same way. It appends a one by one transparent image to the HTML body, served from its own host, and records the fetch. Fast Mail Tracker sets that image to width and height one, an empty alt attribute, and a style of display none. With click tracking on, it also replaces each link in the body with one on its own domain that records the click and forwards the reader onward, minted per recipient so a group email can report who clicked rather than only that somebody did. A pixel has to live in an HTML body, so a tracked email is an HTML email even when you typed plain text, which matters further down.

One place a tracker's own mechanism appears in Google's published guidance is worth quoting rather than glossing over. Google's email sender guidelines say not to use HTML and CSS to hide content in your messages, and that hiding content might cause messages to be marked as spam. A transparent image styled to display none is hidden content by any plain reading. The instruction sits among advice about hidden text and deceptive formatting, and every open tracker including this one works this way, but nobody outside Google can say what weight it carries inside the classifier. Treat anyone who sounds certain here as guessing.

The three reasons Google gives for blocking a message

Google publishes the rejection strings its servers return, in the Gmail SMTP errors and codes reference. Three open with the same phrase and then part company. One says the message is suspicious due to the very low reputation of the sending IP address. One says the same of the sending domain. The third says the message is suspicious due to the nature of the content or the links within.

Two of the three are about who you are. Only the third is about what is inside the message, and when Google names the inside of a message, it names the content and the links. Images do not appear in that sentence.

What a rule actually scores an image at

Gmail's classifier is closed, so there is no number to quote from it. Apache SpamAssassin is open, still filters many corporate and self hosted mailboxes, and its rules are readable. Its image rules form a ladder called HTML_IMAGE_ONLY, defined in the project's HTML tests rule file. Each rung fires when the HTML part holds an image tag and the rendered text falls inside a band, starting at zero to 400 bytes of words and climbing in steps to 2800 to 3200.

The default scores put those rungs between roughly 1.1 and 2.1 points in the configuration most installations run, the one with Bayes and network tests enabled. The threshold for calling a message spam defaults to 5. So a short tracked email does pick up real points on a SpamAssassin filtered recipient, and one rule never comes close to condemning it alone.

Two details in that ladder are directly useful. The top rung, covering 2800 to 3200 bytes of words, is scored at 0.001, which switches it off in practice, and nothing in the ladder matches above 3200 bytes at all. The separate ratio rules that weigh text against total image area, the ones people assume a tiny pixel would trip, are scored at 0.001 as well.

Write more than three thousand bytes of real text and the image rule stops matching. That is the whole mitigation, and it is also just better email.

Why the link is the part that moves

Google's sender guidelines ask two things of links. They should be visible and easy to understand, and recipients should know what to expect when they click. A wrapped tracking link fails both by construction: an opaque identifier on a domain the reader has never heard of, resolving somewhere other than where it appears to go.

The machinery behind that is concrete. Spamhaus publishes a domain blocklist meant to be used during content inspection, by looking up the domains that appear in a message's headers and body, which means the domains inside your links. It carries a return code for exactly this case: 127.0.1.103, an abused legitimate redirector or url shortener, which replaced the older 127.0.1.3 for a spammed redirector in 2014. A redirector shared across many senders is one bad tenant away from that listing, and every link riding on it travels with it. Postmark reported in July 2021, from its own support cases, that customer messages carrying free URL shorteners were blocked at Gmail until the shorteners came out.

What to do if you send one to one

• Read the rejection before changing anything. Google prints which of the three reasons applied, and a domain reputation rejection will not be repaired by touching your tracker.
• Turn link tracking off when the link is the point. Fast Mail Tracker's compose screen carries a switch for it, and with it off nothing in the body is rewritten, so your real URLs go out untouched while opens still record.
• Keep the links you do send pointing at the domain you send from. A link to your own site from your own address asks nothing of the reader and nothing of the filter.
• Write enough text. The rule most likely to notice your pixel stops matching once the message carries a few real paragraphs, which is the email you wanted to send anyway.
• Read a temporary 421 block as a stated reason rather than a queue problem. Sending it again unchanged walks it into the same decision.

Fast Mail Tracker is in early access while Google's security review runs, so places are limited. It separates a confirmed human open from a privacy relay prefetch and a datacenter scanner instead of counting all three, wraps links per recipient so a group send reports who clicked, and lets you send with the wrapping off. If that is the kind of tracking you want, install it from the button below.