Every email analytics dashboard shows opens, and most of them are wrong by an amount nobody can measure. This page explains the mechanism, what changed in 2021, which numbers you can build on, and exactly how tracking is switched on in Notix.
Opens and clicks are tracked in different ways, and the difference is why one is reliable and the other is not.
A one-pixel image is added to the HTML with a URL unique to the message and recipient. When the mail client loads remote images, the fetch is recorded as an open. No images loaded, no open; images loaded by a machine, an open with nobody there.
Each link in the HTML is replaced with a tracking URL that records the click and redirects to the original address. A click needs a deliberate action, so it is a far better engagement signal, with security scanners the main noise.
Apple's Mail Privacy Protection, introduced with iOS 15 and macOS Monterey, changed what an open means. Apple describes it plainly: Mail “downloads remote content in the background by default, regardless of whether you engage with the email,” and routes the download through two relays so that neither one knows both the reader's IP address and the content (Apple, Mail Privacy Protection & Privacy, read on 2026-09-13). Every message to an Apple Mail user with the feature on registers an open at delivery, from an Apple IP, whether or not anyone looked. Corporate security gateways do the same to scan images.
The six counters on the Notix dashboard, per domain and per day, ordered by how much weight they can carry.
| Metric | Where it comes from | How far to trust it |
|---|---|---|
| Sent | Accepted by the API and handed to the receiving server. | Exact. |
| Delivered | The receiving server accepted the message. | Exact. Accepted is not read, but it is the denominator for everything else. |
| Bounced | The receiving server refused, permanently or temporarily. | Exact, with the reason per recipient. |
| Complained | A recipient marked the message as spam and the provider reported it. | Exact for providers with feedback loops; Gmail reports rates, not individuals. |
| Clicked | A rewritten link was followed. | Good. Some security scanners follow links; a click within a second of delivery is usually a scanner. |
| Opened | A one-pixel image in the HTML was fetched. | Weak. Prefetched by Apple Mail and some corporate gateways whether or not anyone looked. |
Use delivered as the denominator and clicks as the engagement signal. Treat opens as an upper bound that is useful for spotting a broken template (opens fall to zero) and useless for ranking subject lines. Bounce and complaint rates are the two that mailbox providers judge you on; they are charted against the limits on the deliverability page.
Per sending domain, not per message. Two switches on the domain's page in the dashboard, both off for a new domain.
Subscribe an endpoint to email.opened and email.clicked and each event arrives signed, with the message id, recipients and subject, and the open or click details. The user agent and platform are what let you discount a machine open.
{
"type": "email.opened",
"data": {
"id": "email_01j9x2mz",
"to": ["someone@example.com"],
"subject": "Your September statement",
"open": {
"timestamp": "2026-09-13T10:30:12Z",
"userAgent": "Mozilla/5.0 ... AppleWebKit/605.1.15 ...",
"ip": "17.57.144.10",
"platform": "Apple Mail"
}
}
}
{
"type": "email.clicked",
"data": {
"id": "email_01j9x2mz",
"to": ["someone@example.com"],
"click": {
"timestamp": "2026-09-13T10:31:40Z",
"url": "https://acme.com/statements/september",
"userAgent": "Mozilla/5.0 (iPhone; CPU iPhone OS 19_0 ...)",
"platform": "Mobile"
}
}
}
Signature verification and the full event list are in the webhook guide and the docs.
Hard bounces against soft bounces, what happens to the address automatically, and the bounce webhook payload your code receives.
LearnHMAC-SHA256 over the timestamp and raw body, a five-minute tolerance, replay protection, and the check in four languages.
ProductOne JSON API for transactional and marketing email: send, batch, schedule, webhooks, typed SDKs.
LearnWhat mailbox providers score, the complaint threshold that matters, warming a new domain, and the honest position on shared IPs.
NotixThe quickstart: verify a domain, copy an API key, send the first email.
Verify a domain, copy an API key, make one call. The free plan does not ask for a card.