Engagement signals: what mailbox providers watch, and why open rates turned into noise

Mailbox providers score your mail partly on what recipients do with it, and they collect that behaviour inside their own apps and webmail, where no tracking pixel is required and no privacy feature blocks the view. Your open rate is a different instrument entirely: a sender-side guess built on a hidden image, and since 2021 Apple Mail has been loading that image by machine whether or not a human ever reads the message. The provider's engagement data is intact. Yours is partly noise, and this lesson is about telling the two apart.

Two vantage points on the same inbox

When Gmail wants to know whether your mail is wanted, it doesn't need your help. It runs the inbox. It can watch a recipient open a message in its own app, reply, forward it, drag it into a folder, rescue it from spam, add you to contacts, or send it to the trash without ever displaying it. That is first-party observation, at whatever level of detail Google chooses to keep.

You see none of that directly. What you get is a reconstruction from two instruments your email tool plants in each message: a tracking pixel (a tiny invisible image hosted on the sender's server; when a mail client displays the message and fetches the image, that fetch is recorded as an "open") and rewritten links, which detour through a tracking domain so each click gets counted on its way to the destination. Useful instruments, but second-hand ones.

The provider watches behaviour. You watch pixels and redirects.

What they infer, and why the weights are secret

From the reputation lesson you know engagement ranks below complaints in the provider's hierarchy. Within engagement, the signals split cleanly.

Positive: a reply, a forward, a move out of Promotions or into a folder, adding the sender to contacts, a rescue from the spam folder. Each is a human spending effort on your mail, and effort is expensive to counterfeit. The reply stands out because it is both rare and deliberate, which is exactly why the paid warm-up networks from the warming lesson exist to manufacture fake ones, and why providers now prohibit those networks in their sender policies.

Negative: the delete-without-read (message listed in the inbox, never displayed, straight to trash), and plain sustained silence, issue after issue, from a growing share of the list. Neither is dramatic on its own. In aggregate, they are how a provider concludes your mail is wallpaper.

What gets inferred from all of this is wanted-ness: per user, which is why the same campaign inboxes for your fans while it folders for the indifferent (the per-user layer from how spam filters decide), and in aggregate for your domain. The exact arithmetic is unpublished, and the opacity is deliberate rather than lazy. A published weighting is a recipe: announce that a reply outweighs ten opens and reply factories appear within the month. So hold the professional posture: know the direction of each signal, and walk away from anyone selling you exact percentages.

What Apple actually broke

Apple Mail Privacy Protection shipped with iOS 15 in 2021. Apple's announcement is blunt about the target: it "stops senders from using invisible pixels to collect information about the user", keeps senders from knowing when a mail was opened, and masks the reader's IP address. Mechanically, when the feature is on (Apple presents it to users as the recommended choice), Apple Mail downloads a message's remote content, tracking pixel included, through Apple's own proxy servers in the background, regardless of whether the person ever looks at the message.

Follow the consequence through. The pixel fires for essentially every Apple Mail recipient, reader or not, at a proxy's timestamp rather than a reading time, from Apple's address rather than theirs. And the scope is set by the mail client, not the mailbox: a Gmail address read in an iPhone's Mail app is covered, while the same person in the Gmail app is not. Your open rate became a blend of real readers and Apple's proxies, with the genuinely silent hidden somewhere inside it, mixed in proportions you can't check because you mostly can't see which client each subscriber uses.

Notice what MPP did not break. It blinds your pixel; Gmail was never using your pixel. Providers observe their own interfaces directly (and even third-party clients leak some behaviour, folder moves and deletions among it, through the sync protocols they connect with). Engagement-based reputation kept working fine. The sender's readout of engagement is what got scrambled.

The other machines in your dashboard

Apple's proxies aren't the only non-humans opening your mail. The secure email gateways from the B2B lesson inspect messages before a human is allowed near them, and inspection means fetching remote images and following links in a sandbox to see where they lead. On business lists both of your metrics inflate: opens fire at delivery time, and clicks land on every link in the message, seconds apart, from recipients who haven't seen it yet. The tell is the pattern. Humans click one link, sometimes, at odd hours. Scanners click all of them, immediately.

What still measures something

Replies, first. Clicks, second, read with the scanner caveat above: steady click behaviour from consumer mailboxes is human, the everything-at-once burst is not. Unsubscribes are human decisions too, and more informative than they feel. Spam complaints are the hardest currency of all, hard enough that providers publish actual thresholds for them, and they get the next lesson to themselves. Even opens keep one use: your own trend against your own history, because the machine share of a stable list is roughly constant, so a real cliff still shows up as a cliff.

Inbox Decay sits outside this entire layer, and I'd rather say so plainly than imply otherwise. Monitoring a domain shows us your records, your delivery path, your blocklist status, and the verdicts receivers stamp into the headers of real messages we grade. It shows us nothing of your subscribers' taps and swipes. Nobody outside the mailbox provider can see those, whatever a vendor's dashboard implies, and the closest public window, Postmaster Tools, is aggregate and Gmail-only. We measure the inputs you control and the evidence receivers hand back; the behaviour layer belongs to the providers.

Engagement decays on its own

A reputation scored on behaviour decays whenever behaviour does, and behaviour decays by default. People change jobs and abandon the inbox you have on file. Interest cools. The subscriber who signed up for a launch two years ago still receives your mail and no longer has a reason to touch it. Send the same quality to the same list for two years and the aggregate engagement drifts downward anyway, which means the inferred wanted-ness drifts with it, which means placement slips while you changed nothing. Part 4 covers the repair kit (list aging, re-engagement, when to let subscribers go). For now, keep the shape of it: an engagement-based reputation leaks by design, and standing still is a slow way of sinking.

Complaints are the one engagement signal providers decided to put hard numbers on; the next lesson covers those thresholds and the feedback loops that report them.

Terms from this lesson

• engagement signals - the recipient behaviours a mailbox provider observes and scores: replies, forwards, folder moves, contact adds and spam rescues on the positive side; deletes-without-read and sustained silence on the negative.
• tracking pixel - a tiny invisible image loaded from the sender's server when a message is displayed; the load is recorded as an open.
• open rate - the share of delivered messages whose tracking pixel fired. Since 2021, a blend of human opens and machine prefetches.
• Mail Privacy Protection (MPP) - the Apple Mail feature that downloads remote content through Apple's proxies in the background, firing tracking pixels whether or not the message is read.
• delete-without-read - trashing a message from the inbox list without displaying it; a negative engagement signal in aggregate.
• link scanning - security software following every link in a message before a human sees it, registering clicks nobody made.

Check yourself

1. Why did Apple Mail Privacy Protection not damage Gmail's ability to score your engagement?

Gmail blocks Apple's proxy servers from fetching imagesMPP only applies to marketing mail, which Gmail scores separatelyGmail observes recipient behaviour in its own apps and webmail, and never depended on your tracking pixelIt did: providers stopped using engagement signals after 2021

2. A campaign report reads: 18,412 delivered, 62% opens, 0.6% clicks. The list is consumer and iPhone-heavy. What does the 62% tell you?

Placement is healthy, since most recipients saw the messageThe subject line is performing wellVery little on its own: Apple Mail preloads tracking pixels, so a large share of those opens can be machinesAuthentication is passing at most providers

3. Within a minute of a B2B send, your dashboard shows opens plus clicks on every link from dozens of corporate recipients. What most likely happened?

The campaign is resonating unusually wellSecurity gateways at the receiving companies fetched the images and followed every link to inspect themYour ESP has a click-counting bugRecipients are forwarding the message to colleagues

Scenario

You run a newsletter whose audience reads mostly in Apple Mail. The open rate has sat near 60% all year. This month it is still 60%, but clicks have fallen by half and the couple of replies you normally get per issue have stopped.

What do you do first?

Rewrite next issue's subject lines to win attention backResend the issue to everyone who didn't clickTreat clicks and replies as the real signal and investigate placement: check your spam rate and reputation in Postmaster Tools, and verify authentication on a real sendConclude nothing is wrong, since the open rate is stable