There are many ways that emails can be used to violate the privacy of the recipient (Return-Receipt-To:, web bugs, iframes loaded from an external page, and other email tracking methods). It may be possible to configure your email client to prevent some or all of these tracking methods, but it requires a bit of knowledge.

Is there any way to test my email client, to determine whether it has any privacy leaks that might allow someone sending me email to track me?

  • Try those methods on yourself? Unless somebody has tried these things on your specific mail client, whichever that is, you you'll have to try these things yourself.
    – Luc
    Commented Nov 7, 2012 at 7:52
  • Thanks, @Luc. I was hoping to find someone who had implemented all of those techniques for me (this is a complex field, and I don't want to spend the time to become an expert in all of the crazy ways you might be able to track people by email). As it happens, I got lucky and found a web service that does that; see my answer.
    – D.W.
    Commented Nov 7, 2012 at 8:49

2 Answers 2


I found a web service to test your email client, to see whether it protects your privacy:


It automates the process of sending you an email that uses various tricks to try to track you, and then checks to see which of those succeed. It lists 37 different methods that it implements to try to determine whether you opened the email, track you, etc. It looks like a pretty reasonable approach.

The author has found attacks and vulnerabilities in a number of email clients, which enable an email sender to violate the privacy of the recipient. His software implements these attacks. He describes some of these attacks on his blog:

  • 1
    That's pretty cool! As far as I can tell, gmail's legit, which isn't that surprising considering all of the rewards they give for vulnerability discoveries.
    – rofls
    Commented Nov 8, 2012 at 6:28
  • 1
    After opening the email in Thunderbird the result page was showing zero red tests, which is good. Then I realized Thunderbird is blocking all remote content on the messages by default; after I hit the show remote content in this message, which is the default for some folks, 16 tests turned red.
    – Daniel
    Commented Jan 26, 2015 at 23:40

It's not just your email client when you use email (browser, computer), so you should probably start with:

a) searching within your specific email client to make sure it's not sending receipts

b) checking your browser's privacy settings and make sure it's blocking cookies, (at least before going to your email) because the email client may request them, and then get information from your browser that way

c) using a browser that does not support iframes

Obviously there could be more ways that someone could track you, but unless you know of them specifically, using up-to-date browsers, email clients and operating systems is the most practical way of combating those attempts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .