What data supports filtering tools clicking on links in emails?

Summary

A wide range of filtering tools, security software, ESPs, and email receivers click links in emails for various reasons, including security scanning, reputation assessment, engagement tracking, and inbox placement testing. Google crawlers, Microsoft's Safe Links, Cisco's Email Security Appliance, Proofpoint's URL Defense, and Spamhaus all actively analyze links for malicious content, spam detection, and reputation. Automated systems, including those used for link tracking, image proxying, and URL wrapping, trigger clicks. These bot clicks, often caused by security software pre-fetching URLs or validating links, can inflate click rates, but can be differentiated from legitimate clicks by analyzing user agents and IP addresses. Email authentication failures and the use of link cloaking or shortening can also be indicators of automated scanning.

Key findings

  • Security Software Scans: Security software and filters, including those from major providers like Microsoft and Cisco, actively scan links in emails.
  • URL Wrapping/Rewriting: URL wrapping and rewriting for security or tracking purposes generates automated clicks.
  • Reputation Checks: Link reputation checks by email receivers and security tools trigger clicks.
  • Bot Clicks Inflate Rates: Automated bot clicks can significantly inflate click-through rates in email campaigns.
  • Analysis Enables Differentiation: Analyzing user agents and IP addresses can help differentiate bot clicks from genuine user interactions.

Key considerations

  • Monitor User Agents: Regularly monitor user agents to identify automated systems and unusual activity.
  • Track IP Addresses: Track IP addresses to identify potential bot activity and block suspicious sources.
  • Assess Authentication: Investigate links between email authentication failures and security scanning.
  • Review Security Settings: Review ISP and corporate filter settings for automated URL pre-fetching.
  • Consider Honeypot Links: Use honeypot links to identify and block malicious bots.
  • Monitor Link Cloaking: Understand how link cloaking and shortening services impact automated scanning and click rates.

What email marketers say
9Marketer opinions

Filtering tools, security scanners, and email providers often click on links in emails for various reasons, including checking for malicious content, tracking user engagement, validating links, and gathering data for inbox placement testing. This automated link clicking can be triggered by URL defense mechanisms, image proxying, link tracking, seed testing, and even link cloaking/shortening services. Consequently, these automated clicks may inflate click rates, requiring careful analysis of user agents and IP addresses to differentiate them from genuine user interactions.

Key opinions

  • Security Scanning: Filtering tools and security scanners actively click links to identify malicious content.
  • Engagement Tracking: Email providers use link clicks to track user engagement and gather data.
  • Link Validation: Many email clients automatically validate links, generating clicks even without user interaction.
  • Inbox Placement Testing: Seed testing for inbox placement involves link clicks to assess deliverability.
  • Inflated Click Rates: Automated link clicking by bots and scanners can artificially inflate click-through rates.

Key considerations

  • Differentiate Bot Clicks: Analyze user agents and IP addresses to differentiate bot clicks from genuine user clicks.
  • Monitor Link Cloaking Impact: Be aware that link cloaking and URL shortening can be influenced by automated scanners.
  • Review Security Settings: Understand that security settings may automatically be triggering some URL clicks.
  • Utilize Honey Pot Links: Create and leverage honey pot links to identify and block bots.
  • Implement IP Tracking: Track the IP addresses of bots to understand the scale of the impact and block IPs where necessary.
Marketer view

Email marketer from StackExchange says that sometimes scanners will click on all the links in your email at once, and that it's possible to track the bot's IP address or create honey pot links to block the bot.

July 2022 - StackExchange
Marketer view

Email marketer from Email on Acid notes that many email clients and security programs automatically validate links in emails, resulting in clicks being registered even if a human recipient doesn't click the link.

May 2023 - Email on Acid
Marketer view

Email marketer from Email Marketing Tips shares that link cloaking and URL shortening services, while useful for tracking, can also be triggered by automated scanners, leading to inflated click rates.

June 2022 - Email Marketing Tips
Marketer view

Email marketer from Validity (formerly Return Path) explains that seed testing for inbox placement involves sending emails to various email providers and tracking whether the emails reach the inbox, spam folder, or are blocked. These tests may also register link clicks due to security scanning.

August 2024 - Validity
Marketer view

Email marketer from Reddit discusses the issue of bot clicks on links, stating that these clicks can be triggered by various automated systems, including security scanners and anti-virus software.

December 2022 - Reddit
Marketer view

Marketer from Email Geeks shares that Proofpoint vaguely mentions checking URL safety in real-time in their marketing materials for URL defense.

April 2022 - Email Geeks
Marketer view

Email marketer from Stack Overflow explains that tracking email opens and clicks is generally done using a combination of techniques, including adding a tracking pixel and rewriting URLs to point to a tracking server. The tracking server then redirects the user to the original URL, and the fact that this redirection happens counts as a click.

January 2024 - Stack Overflow
Marketer view

Email marketer from Litmus shares that image proxying and link tracking can trigger clicks on links within emails as part of security and data collection processes by various email clients.

February 2022 - Litmus
Marketer view

Email marketer from Mailgun explains that automated link tracking and scanning by email providers may involve clicking on links within emails to check for malicious content or to gather data on user engagement.

February 2022 - Mailgun

What the experts say
3Expert opinions

Filtering tools, security software, ISPs, and email receivers actively click links in emails for security scanning and reputation assessment purposes. Bot clicks are a tangible phenomenon, often triggered by security software and filters pre-fetching URLs or wrapping URLs to check their reputation. Distinguishing these bot clicks from legitimate user clicks is possible through analysis of user agents and IP addresses, especially in the context of potential email authentication failures which might indicate security scanning.

Key opinions

  • Bot Clicks Real: Security software scans links, and ISPs/corporate filters prefetch URLs.
  • URL Wrapping Causes Clicks: URL wrapping by security tools and ESPs can result in clicks.
  • Reputation Checks: Email receivers use URL wrapping and link reputation checks to assess senders.
  • Differentiation Possible: Bot clicks can be differentiated by user agent or IP address analysis.

Key considerations

  • Analyze User Agent: Carefully analyze the user agent to identify automated systems.
  • Monitor IP Addresses: Track IP addresses associated with link clicks to identify potential bot activity.
  • Consider Authentication: Email authentication failures may correlate with security scanning behavior.
  • Review Filter Settings: Investigate ISP and corporate filter settings that might pre-fetch URLs.
Expert view

Expert from Spamresource answers that url wrapping and link reputation checks are used by many email receivers to assess the reputation of the sender of the mail.

January 2024 - Spamresource
Expert view

Expert from Word to the Wise explains that URL wrapping by security tools and some ESPs can result in clicks, and email authentication failures might suggest a possible link between authentication and security scanning.

February 2023 - Word to the Wise
Expert view

Expert from Word to the Wise explains that bot clicks are indeed a real thing; security software can scan links, and some ISPs and corporate filters will prefetch URLs. These clicks can be differentiated from legitimate clicks by analyzing the user agent or IP address.

September 2022 - Word to the Wise

What the documentation says
5Technical articles

Email filtering tools, including those from Google, Microsoft, Cisco, Proofpoint, and Spamhaus, actively click on links in emails for various security and analytical purposes. Google's crawlers may follow links in publicly accessible emails. Microsoft's Safe Links feature checks URLs before opening them. Cisco's Email Security Appliance scans URLs for malicious content. Proofpoint's URL Defense rewrites URLs and checks destination safety, logging initial clicks. Spamhaus employs automated systems to analyze links for spam detection and reputation assessment. These processes all result in data showing that filtering tools are clicking on links in emails.

Key findings

  • Google Crawlers: Google crawlers may follow links in publicly accessible emails.
  • Microsoft Safe Links: Microsoft's Safe Links checks URLs before opening them, warning users of malicious websites.
  • Cisco Email Security: Cisco's Email Security Appliance scans URLs for malicious content.
  • Proofpoint URL Defense: Proofpoint's URL Defense rewrites URLs and checks their safety in real-time, logging clicks.
  • Spamhaus Link Analysis: Spamhaus analyzes links in emails for spam detection and reputation assessment.

Key considerations

  • Public Accessibility: Understand that publicly accessible emails may be crawled and links followed by Google.
  • Safe Links Impact: Be aware that Microsoft Safe Links checks can trigger link verifications before user access.
  • Security Appliance Scanning: Cisco email security appliances can follow links in emails.
  • URL Rewriting: Proofpoint's URL rewriting can log initial clicks from automated checks.
  • Spamhaus Reputation: Link analysis by Spamhaus affects sender reputation.
Technical article

Documentation from Cisco explains that their Email Security Appliance scans URLs in emails, and this may involve following the links to analyze the content for malicious behavior before delivering the email to the recipient.

August 2024 - Cisco
Technical article

Documentation from Spamhaus outlines that they employ various methods to track and detect spam, including analyzing links in emails. This process involves automated systems that may follow links to assess the content and sender reputation.

January 2025 - Spamhaus
Technical article

Documentation from Microsoft Learn details the Safe Links feature in Microsoft Defender for Office 365, which rewrites URLs in incoming email messages. When a user clicks a URL in a message, the URL is checked *before* the website is opened. If the URL is found to lead to a malicious website, the user is warned.

February 2023 - Microsoft Learn
Technical article

Documentation from Google Web Search Central explains that Google crawls the web by using automated programs called crawlers, and these may follow links in emails if the emails are publicly accessible.

April 2024 - Google Web Search Central
Technical article

Documentation from Proofpoint outlines that their URL Defense product rewrites URLs and checks the destination website's safety in real-time when a user clicks the link. This can lead to initial clicks being logged by the system as it verifies the link.

September 2024 - Proofpoint