Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be possible to configure your email client to prevent some or all of these tracking methods, but it requires a bit of knowledge.

Is there any way to test my email client, to determine whether it has any privacy leaks that might allow someone sending me email to track me?

share|improve this question
Try those methods on yourself? Unless somebody has tried these things on your specific mail client, whichever that is, you you'll have to try these things yourself. – Luc Nov 7 '12 at 7:52
Thanks, @Luc. I was hoping to find someone who had implemented all of those techniques for me (this is a complex field, and I don't want to spend the time to become an expert in all of the crazy ways you might be able to track people by email). As it happens, I got lucky and found a web service that does that; see my answer. – D.W. Nov 7 '12 at 8:49
up vote 12 down vote accepted

I found a web service to test your email client, to see whether it protects your privacy:

It automates the process of sending you an email that uses various tricks to try to track you, and then checks to see which of those succeed. It lists 37 different methods that it implements to try to determine whether you opened the email, track you, etc. It looks like a pretty reasonable approach.

The author has found attacks and vulnerabilities in a number of email clients, which enable an email sender to violate the privacy of the recipient. His software implements these attacks. He describes some of these attacks on his blog:

share|improve this answer
That's pretty cool! As far as I can tell, gmail's legit, which isn't that surprising considering all of the rewards they give for vulnerability discoveries. – rofls Nov 8 '12 at 6:28
After opening the email in Thunderbird the result page was showing zero red tests, which is good. Then I realized Thunderbird is blocking all remote content on the messages by default; after I hit the show remote content in this message, which is the default for some folks, 16 tests turned red. – Daniel Jan 26 '15 at 23:40

It's not just your email client when you use email (browser, computer), so you should probably start with:

a) searching within your specific email client to make sure it's not sending receipts

b) checking your browser's privacy settings and make sure it's blocking cookies, (at least before going to your email) because the email client may request them, and then get information from your browser that way

c) using a browser that does not support iframes

Obviously there could be more ways that someone could track you, but unless you know of them specifically, using up-to-date browsers, email clients and operating systems is the most practical way of combating those attempts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.