Half of your email opens are robots. Here's how to find the real number.

import FAQ from “../../components/blog/FAQ.astro”; import ComparisonTable from “../../components/blog/ComparisonTable.astro”;

If your cold email tool says your open rate is 60%, here is the uncomfortable question: opened by whom?

Where fake opens come from

An email “open” is measured with a tracking pixel — a tiny invisible image. When the image loads, the sender counts an open. The problem is that in 2026, most image loads aren’t people:

• Apple Mail Privacy Protection pre-loads every image on Apple’s servers the moment the email arrives — whether the recipient ever looks at it or not. If your list has iPhone users, a chunk of your “opens” fire at delivery time, all by themselves.
• Gmail’s image proxy fetches and caches images through Google’s servers. The first load tells you almost nothing about a human being present.
• Corporate security scanners (Outlook ATP, Proofpoint, Mimecast) open every email and click every link in it before letting it through to the inbox. Yes — your click rates are inflated too.

Put together, it’s common for 40–60% of recorded opens to be machines. Your 60% open rate might be 30% of humans — or it might be 55%. The point is: you don’t know, and most tools won’t tell you.

<ComparisonTable headers={[“Source”, “Triggers at”, “Also inflates clicks?”]} rows={[ { label: “Apple Mail Privacy Protection”, values: [“Delivery time, regardless of recipient action”, false] }, { label: “Gmail image proxy”, values: [“First image load, low signal either way”, false] }, { label: “Corporate security scanners”, values: [“Pre-delivery scan of the whole message”, true] }, ]} />

Why this actually happens

None of these three sources exist to mess with your metrics — they’re each solving a real problem for someone else, and your open-rate math is just collateral damage. Apple introduced Mail Privacy Protection specifically to stop senders from knowing whether, when, or from where a recipient opened an email — routing every image request through Apple’s own servers at delivery time is the mechanism, and the side effect is that “opened” stops meaning what it used to the moment a meaningful share of your list uses Apple Mail on iPhone, iPad, or Mac. Gmail’s image proxy predates that by years and exists for a different reason: caching images on Google’s own infrastructure protects recipients from senders using tracking pixels to fingerprint devices or confirm live inboxes for spam targeting, and as a side effect, it also means the very first “open” your platform sees may just be Google’s proxy warming its cache, not a person looking at anything. Corporate security scanners are the most aggressive of the three by design: they’re built to detonate anything a phishing email might do — opening it, clicking every link, sometimes even submitting forms — inside an isolated environment, before a human employee ever sees the message, specifically so a malicious payload never reaches a real inbox. All three are legitimate, sensible engineering decisions made by companies protecting their own users. They just happen to make “open rate,” as most tools report it, a number that increasingly measures software behavior more than reader behavior.

Why this actually matters

Inflated numbers wouldn’t matter if everyone just ignored them. But nobody ignores them — teams make real decisions on fiction:

• You pick the A/B winner by opens, and crown the variant that bots happened to like.
• You judge a list or a copy angle as “working” because opens look healthy, while actual humans never saw the email.
• You keep sending to dead segments because auto-opens make them look alive — and dead segments are exactly what poisons your sender reputation.

The cruel part: the metric that can’t be faked — replies — is the one that pays the bills, and it’s the one most dashboards bury.

A concrete version of this: imagine two cold email variants sent to the same 500-person list. Variant A gets a 58% recorded open rate and 4 replies. Variant B gets a 34% recorded open rate and 11 replies. On raw opens, Variant A looks like the clear winner — nearly double the engagement. But if Variant A’s subject line happened to render in a way that triggered more automated preview fetches (some corporate scanners and preview panes load images just from a message landing in the inbox, before anyone reads it), a chunk of that 58% never involved a human at all. Variant B’s lower open number paired with a much higher reply rate is the more honest signal that it actually landed with real people — and a team optimizing purely on the open-rate column would ship the worse email and never know why replies stayed flat afterward.

How to find your real number

You don’t have to accept the fiction. A few practical steps:

1. Treat opens as a directional signal, never a KPI. If a decision matters (winner selection, list pruning, pausing a campaign), make it on replies, positive replies or meetings.
2. Look at open timing. Opens that fire within seconds of delivery, at 3am in the recipient’s timezone, or in perfectly uniform bursts are machines. Human opens cluster in working hours and trail off over days.
3. Segment by provider. If your “openers” are overwhelmingly on Apple domains, assume Mail Privacy Protection is doing the opening.
4. Use a platform that classifies before it counts. The detection signals (proxy fingerprints, fetch timing, user-agent patterns) are visible at the moment the open happens — a platform can check each one and label it human, machine, or uncertain instead of dumping everything into one number.

That last one is, transparently, what we built Norbelys to do: every open and click is verified as it happens, and the dashboard shows you real opens — with the filtered bots listed right next to them, so you can see exactly what was removed.

The honest trade

Filtering makes your numbers smaller. A 41% real open rate looks worse than 64% of fiction in a Monday report — until you remember that only one of them predicts replies.

Lower numbers you can act on beat higher numbers you can’t. That’s the whole trade, and it’s a good one.

<FAQ items={[ { question: “Should I stop tracking opens entirely?”, answer: “No — opens are still useful as a rough, directional signal (a campaign with zero opens at all across a whole list usually means a deliverability problem, not just bot noise). The mistake is treating the raw number as precise enough to decide anything on its own.” }, { question: “Why do click rates get inflated too, not just opens?”, answer: “Some corporate security scanners don’t just load images — they follow every link in the message to check where it leads before the email reaches a human inbox, which registers as a click in most tracking setups even though nobody has actually clicked anything yet.” }, { question: “Is this worse for B2B or B2C senders?”, answer: “B2B lists tend to see more of the security-scanner effect, since corporate email gateways are common in professional environments; B2C and consumer lists see more of the Apple Mail Privacy Protection effect, since personal Apple device usage is higher there. Either way, the fix — weighting replies over opens — is the same.” }, ]} />