Have you ever had the feeling that Someone is watching you even inside your own email.It's not your imagination: many of the emails you receive include invisible trackers that record when you open them, from which device, where you are, and even how many times you revisit them. All without you seeing anything unusual on your screen and, of course, without anyone explicitly asking for your permission.
This tracking is based primarily on small pixel trackers and special links embedded in messages. The good news is that you can stop them with a few adjustments and, above all, by taking advantage of local DNS servers that block those tracking domains. before your computer or mobile device even connects to them. Let's look at it step by step, calmly, and without needing to be a system administrator.
What are email trackers and why are they so invasive?
When you open a seemingly innocent HTML email, your email client (Gmail, Outlook, Apple Mail, etc.) starts downloading external resources: images, icons, logos… and hidden within that content… a tiny image of 1×1 pixel or even 0×0 in size, completely transparentThat "non-image" is requested from a remote server, and that's where the fun begins for whoever is tracking you.
The moment the pixel is downloaded, the sender's or marketing platform's server records the exact date and time of opening, your IP address, device type, operating system, email client, and even screen resolutionSince the pixel URL is usually unique for each recipient, the system knows exactly which specific person opened that message.
In addition to pixels, many emails include tracking links with UTM parameters or other identifiersEven if you have images blocked, as soon as you click on a link in the newsletter, a banner in the signature, or a "view offer" button, you first go through an intermediary server that records your click, your IP address, your browser, and the page you go to next. All of this is added to your browsing behavior profile.
With these two pieces —pixel and link— companies can Reconstruct your email usage pattern: reading times, response frequency, devices used, locations from which you connect and even how long it takes you to react to certain messages. We're not just talking about mass marketing campaigns: many corporations already include this type of tracking without the recipients (and sometimes even the employees themselves) knowing.
Code, web beacons, and what data is actually collected
In practice, email tracking works thanks to Web beacons implemented as images or small scriptsOn web pages, JavaScript is often used to go beyond a simple pixel, but in email, those tiny images take center stage precisely because email clients almost always block active code.
Each time the pixel is downloaded, the server records an entry that usually includes the unique URL associated with your email address, the originating IP address, the user-agent (browser/client), and the email or campaign reference.If the company combines that event with browser cookies or advertising identifiers, it can link what you do on the web with what you do in email.
From this, all sorts of inferences can be drawn: When do you work, from which city or country do you usually connect, do you travel frequently, do you use your mobile phone or computer more?What topics interest you, which brands you interact with most, or how long you spend reading a message before taking action. In the corporate environment, these metrics are also used to evaluate the sales "performance" of employees through their companies.
From analytics to crime: commercial and criminal use of trackers
It's not just legitimate marketing that takes advantage of these mechanisms. Cybercriminals are integrating pixels into phishing campaigns and reconnaissance emails. to find out which addresses are active, when email is checked, and what devices are on the other end.
With this information they can program spear phishing attacks or business email compromise (BEC) The tracking strategy targets times when the victim is typically offline or off guard, or focuses its efforts on accounts that interact most frequently with certain types of messages. Furthermore, the tracking infrastructure—servers, databases, analytics dashboards—can be compromised just like any other system.
When a breach occurs at an email marketing or automation provider (Mailchimp, Klaviyo, ActiveCampaign and others have already had incidents), Not only are mailing lists exposed, but also interaction histories: who clicked on what, when and from whereThis type of data is gold for highly refined fraud campaigns, for example targeting people interested in cryptocurrencies, investments, or certain services.
Legal limitations and the problem of consent
At the regulatory level, things are still only half-baked. In the European Union, the GDPR considers that Tracking emails using pixels constitutes the processing of personal data.and therefore requires clear consent, transparent information, data minimization and reasonable retention periods.
On paper, companies should Explain in an accessible way what they track, why, and how you can opt out.In addition to documenting that consent and allowing it to be easily revoked, in practice, the mention of tracking is usually buried in a forgotten paragraph of an endless privacy policy that no one reads, or consent is assumed because you subscribed to something years ago.
In the United States the picture is more fragmented. State laws such as the CCPA in California give users some control over what data is collected and how it is sold.And the FTC has already fined healthcare companies for using pixels without proper notification. But in everyday life, it remains difficult for the average user to complain and get these trackers removed from their control.
How do major email clients respond?
Faced with growing concern, some email clients and services have begun to take action. Apple Mail incorporated the Mail Privacy Protection, which acts as a proxy and preloads remote content from Apple serversso that the sender sees a generic IP and "fake" opens that distort their statistics.
Gmail, for its part, It serves most of the images through its own servers.This prevents the sender from seeing your real IP address, but the system still records that the message has been opened, so tracking remains useful for the campaign sender, although somewhat less precise in terms of location.
Outlook takes a somewhat cruder approach: It blocks the downloading of external images by default. It then displays a notification to upload them manually. As long as you don't press the "show images" button, the pixel isn't downloaded and the tracker isn't triggered. However, as soon as you decide to view the full email, you provide all the usual information.
In contrast, privacy-oriented providers such as Proton Mail, Tuta, or StartMail, which by default block remote content, remove known pixels, and clean tracking parameters in linksMany also act as image proxies to prevent your real IP address from reaching third-party servers.
Base layer: disables automatic image loading
The first firewall against tracking pixels is very simple: Prevent external images from automatically uploading to your emailsSince most trackers are implemented as 1x1 images, blocking them cuts off a good portion of the spying at the root.
In Gmail you can go to the general settings and change the images option to “Ask before showing external images”This means that each HTML message will be displayed without graphics until you authorize it. Outlook offers similar options in the Trust Center to prevent automatic downloads, and Apple Mail allows you to disable remote content uploading or enable email privacy protection to reduce tracking accuracy.
Any drawbacks? Some newsletters will look less attractive or legible until you click the upload button. On the other hand, No one collects data about your openings without your consent.If you need an extreme level of protection, you can even configure your client to view everything in plain text, foregoing HTML; it's inconvenient, but it eliminates pixels, scripts, and much of the tracking based on links embedded in images.
Anti-tracking browser extensions and add-ons
If you check your email from your browser, you have another advantage: extensions that detect and block specific email trackers and choose more secure browsers It also helps. Some, like Ugly Email or PixelBlock, flag Gmail messages that use pixel trackers and prevent them from loading, displaying an eye or alert icon next to the subject line.
Others, Trocker type, They work across various services (Gmail, Outlook, Yahoo…) and not only block pixels, but also flag tracker links.showing where they hide within the message body. Then there are the classic content blockers, such as uBlock Origin, which, thanks to their filter lists, can prevent calls to known analytics domains, even in the context of webmail.
However, we need to be careful here: Any extension you ask to analyze your inbox has very sensitive access to your email.It is essential to install only add-ons from official sources (Chrome Web Store, Firefox Add-ons, etc.), check reviews, code (if it is free software) and requested permissions, and not accumulate unnecessary extensions.
Privacy-focused email providers and customers
If you're truly concerned about tracking, it's worth considering more than just quick fixes: Migrate part of your email activity to services that have been designed from the ground up to minimize your footprintProton Mail, Tuta, or StartMail automatically block many trackers, offer end-to-end encryption, and are usually based in countries with stricter privacy laws.
In combination with these providers, you can use desktop email clients that reinforce that philosophy. Customers who store data locally and do not add their own analytics layer or proprietary cloud They reduce the attack surface and exposure to third parties. The idea is that even the provider doesn't have the technical capacity to readily collaborate with commercial surveillance, because they lack access to the content and a large part of the metadata.
Email aliases and disposable accounts to reduce exposure
Another very useful piece of the puzzle is learning to separate identities using email aliases or alternative addressesInstead of providing your primary email address for each registration, newsletter, or online store, you can use aliases generated by services like SimpleLogin, Proton Pass, or other similar managers.
These aliases act as intermediaries: The messages are forwarded to your actual inbox, but trackers can slip through along the way, and most importantly, you don't expose your main address.If an alias starts receiving spam, phishing attempts, or excessive tracking campaigns, you simply deactivate it. It also allows you to detect which service has sold or leaked your data.
For more specific uses—free trials, registering on websites that don't seem right, quick downloads—you can use temporary or disposable emailsThis way you keep your regular inbox much cleaner of unnecessary newsletters and reduce the number of tracked emails that actually affect you.
Network-level blocking: Leveraging filtering local DNS
So far we've talked about client-side defense (applications, extensions, email settings). But there's a very powerful layer that many people overlook: Blocking tracking domains using filtering local DNS on your system or home router.
When your email client tries to load a pixel or resolve a tracking URL, the first thing it does is ask the DNS system which IP address corresponds to that domain (for example, something like track.example-email.com). If instead of using the operator's or Google's DNS you point your devices —for example by activating the Private DNS mode on Android- still DNS server that filters domains used for advertising, analytics, and trackingMany of those requests will simply fall by the wayside.
Filtering DNS services (some integrated into security solutions or VPNs, others deployable on your own network like Pi-hole, AdGuard Home, and similar) work by maintaining lists of domains known to host beacons, pixels, tracking scripts, ad networks, and even malwareEach time your computer tries to resolve one of those domains, the DNS returns an empty or false response, so the resource is never downloaded.
The advantage of this approach is that It protects all devices that access the internet through that DNS: computers, mobile phones, tablets, Smart TVs, email apps, webmail in the browser, and even mobile applications that integrate trackers.It's a global shield: even if an email client doesn't have the option to block images, the DNS prevents it from contacting the tracking server.
Configure local DNS tracker blockers
To use this approach you have two paths: Point your devices to a public DNS with built-in blocklists or set up your own filtering DNS server on the local network (for example, on a Raspberry Pi or a small home server).
In the first scenario, you just need to go to the network settings of your operating system or your router and Change your DNS servers to those of a provider that offers protection against trackersMany VPN services include this type of secure DNS, so when you activate the VPN, you also get ad blocking and tracking protection. The browser doesn't even notice; calls to certain domains simply stop resolving.
If you prefer maximum control, you can deploy solutions like Pi-hole or AdGuard Home on your network. These tools They act as a local DNS resolver, download blocklists, allow you to add domains manually, and show statistics on what is being blocked.Simply configure the router to assign the IP address of that local server as the primary DNS server to all devices in your home.
From the point of view of email pixels, the effect is devastating: When the client tries to download the tracking image from the email marketing platform's domain, the DNS query falls into a black hole, there is no valid IP address, and the pixel does not load.The sender never receives the open event, even if you have enabled images in the client.
VPN and DNS: a combination to hide IP and block beacons
An additional layer you can add to all of the above is the use of a A reliable VPN that offers both traffic encryption and DNS-level tracker blockingWhen you connect through the VPN, your public IP address becomes that of the VPN server, not your home or mobile connection.
This ensures that even if a crawler manages to load (because it uses a domain not included in the blocklists, for example), The IP and location information received by the sender does not directly identify you.In parallel, many VPN services add a “NetShield” type layer that works the same as a Pi-hole, but is managed by the provider, blocking advertising and tracking domains in both browsing and email.
It is important to be clear, however, that A VPN is not a magic solution that disables all email trackers.The pixel can still register opens—albeit with a generic IP address—and the tracking links will continue to record clicks. Therefore, a VPN should be seen as a complementary tool to email client blocking, extensions, and filtering DNS.
Good personal practices: habits that reduce tracking
No tool can replace common sense or reviewing the privacy settings of your mobile phone. A very important part of protection against pixel trackers consists of change some habits with emailThe first, quite obvious: don't lightly open messages from senders you don't know or that seem suspicious, especially if they are mass mailings or promotions you don't remember requesting.
Many clients and services offer previews or dedicated tabs for promotions and notifications that They allow you to review the issue and some of the content without uploading images or activating trackers.If something raises any doubts, it's best to send it directly to spam or the trash. And if your inbox is full of newsletters you no longer read, taking a few minutes to unsubscribe from the unwanted ones instantly reduces the area available for tracking.
If you share devices or accounts with family, friends, or colleagues, it's important Explain what measures have been taken (image blocking, extensions, filtering DNS) and what types of emails they should not open or forward carelessly.It's not very useful for you to be careful if someone else then clicks on anything that arrives in the shared inbox.
Added security risks: enhanced phishing and fingerprinting
Beyond privacy concerns, email trackers open the door to serious security risks. We've discussed how attackers use pixels to validate addresses and timestamps, but there's more. With data such as device, system version, email client, and browser, an attacker can fine-tune exploits and malware campaigns for your specific environment..
If email information is combined with cookies and browser fingerprinting, it is possible Track your activity across devices, link emails to browsing histories, and correlate online and offline actionsThis persistent digital footprint makes it very difficult to "disappear" even if you change your email address or delete cookies, because tracking systems are based on almost unique characteristics of your hardware and software.
Future prospects and market pressure
Everything suggests that this battle is going to escalate. On one hand, Regulators are taking a tougher stance on the opaque use of pixels and beacons in sensitive sectors such as health or finance, and we have already seen significant fines for companies that shared patient data with advertising platforms through these mechanisms.
On the other hand, more and more users value privacy as a decisive criterion when choosing digital services. Email providers, VPNs, browsers, and even desktop email clients have taken notice and are using anti-tracking protection as a selling point.We're likely to see more built-in locking features, without having to resort to external extensions.
In parallel, more advanced technical solutions are maturing: AI-powered tracker detection, more decentralized email protocols, and encryption that better protects metadata as well. and data warehouses under user control. None of this will eliminate email marketing, but it can reduce the scope for silent surveillance.
Taking all this into account, it becomes clear that the best defense against invisible pixels and other email trackers involves combining several layers: Client settings (image blocking, plain text when necessary), well-chosen extensions, privacy-focused providers and aliases, smart VPN usage, and, most importantly, filtering local DNS that cut off access to tracking domains at the root..
With these pieces in place and slightly more prudent habits, reading email again resembles what it should always have been: a private activity, without timers or curious eyes watching every click out of the corner of your eye. Share this guide so other users will learn about the topic.