If your cold email dashboard shows 50-70% opens, run this audit before you report it to anyone. Three machines fetch the tracking pixel on behalf of your recipient, and a naive counter calls all of them an "open".
1. Apple Mail Privacy Protection
Since iOS 15, Apple Mail pre-fetches remote images for users who enable MPP, whether or not the message is ever read. The fetch comes from Apple's proxy, so it looks like a normal image load.
2. Gmail's image proxy
Gmail rewrites image URLs through googleusercontent.com and fetches them itself. Two reliable tells:
- A frozen user agent:
Chrome/42.0.2311.135 ... Edge/12.246- a browser combination that has not existed in years. It does not contain the stringGoogleImageProxy, which is why classifiers that only look for that token miscount it. - Google egress ranges:
66.249.,66.102.,64.233.,209.85.
3. Corporate security scanners
Microsoft 365 with Defender, Barracuda, Mimecast, Proofpoint and friends detonate or rewrite every URL in an inbound message, images included. A scanner in Frankfurt "opens" your email before the recipient's laptop is awake.
The ten-minute audit
Export the raw events from your sending tool - not the summary, the per-event log with IP and user agent - then check four things:
| Check | What a machine hit looks like |
|---|---|
| Repeated hits from one IP | Same IP loading the pixel 4-10 times within a minute |
| User agent | datacenter strings, the frozen Chrome 42 / Edge 12 pattern, python-requests
|
| Timing | machine fetches land in a tight band right after send; humans spread across days |
| IP ownership | Google, Apple, Microsoft or a security vendor instead of a residential ISP |
On our own sends the naive number was 61% and the human-only number was 34%. The click rate barely moved between the two definitions, which tells you which metric was real all along.
What to measure instead
- Replies per 100 sends - a proxy cannot fake these
- Human opens, defined explicitly and de-duplicated per recipient
- Bounce and complaint rates for deliverability work
The uncomfortable part: honest tracking makes your numbers look worse than the competition's. If a vendor shows 60% where you measure 34%, the vendor is not better at email - it is counting prefetches.
Originally published at pay.trytoolboxpro.com. I build a Gmail outreach tool that classifies opens this way; the audit above works whether or not you use it.
Top comments (1)
the frozen chrome 42 / edge 12 detail is my favorite. practically a fingerprint that begs to be caught. do the scanner fetches ever land late enough to blur into human-open timing, or does the tight band right after send stay a reliable separator?