Copy page

Tracking

Email Tracking

Overview

Email tracking lets you measure engagement by detecting when recipients open your emails and click links. Tracking is configured at the route level, giving you granular control over which emails are tracked.

Key features:

• Open tracking — Know when recipients view your emails
• Click tracking — Track which links recipients click
• Custom tracking domains — White-label tracking links with your own domain (Pro)
• Bot detection — Filter out automated opens and clicks from analytics
• Webhook events — Receive real-time notifications for engagement

How It Works

Open Tracking

When open tracking is enabled, Lettermint automatically injects a transparent 1x1 pixel image before the closing </body> tag of HTML emails. When the recipient's email client loads this image, we store the request as a tracking observation and classify it before it contributes to customer-visible events and metrics.

Click Tracking

When click tracking is enabled, Lettermint rewrites links in your email to route through our tracking domain (t.ltrmnt.com). When a recipient clicks a link:

1. The request hits our tracking server
2. We store the click observation with timestamp and link URL
3. The recipient is immediately redirected to the original destination
4. The observation is classified before it contributes to customer-visible events and metrics

Both tracking methods use secure, signed tokens that expire after 30 days to protect recipient privacy.

Configuration

Tracking is configured per-route in your project settings. This allows you to:

• Enable tracking only for marketing/broadcast routes
• Keep transactional emails tracking-free for simplicity
• Test tracking on specific routes before wider rollout

Per-Email Overrides

Route settings are the default for every email sent through that route. You can override open and click tracking for a single email without changing the route configuration.

For API sends, add a settings object to the email payload:

Code
{
  "from": "sender@yourdomain.com",
  "to": ["recipient@example.com"],
  "subject": "Your receipt",
  "html": "<p>Thanks for your order.</p>",
  "settings": {
    "track_opens": false,
    "track_clicks": false
  }
}

For SMTP sends, add Lettermint override headers:

Code
X-LM-Override-Track-Opens: false
X-LM-Override-Track-Clicks: false

These overrides apply only to the email that includes them and take precedence over the selected route's tracking settings.

Enabling via Dashboard

1. Navigate to your project in the dashboard
2. Go to Routes and select your route
3. In Route Settings, toggle Track Opens and/or Track Clicks
4. Save your changes

Enabling via API

Use the Team API to configure tracking programmatically:

Code
curl -X PATCH https://api.lettermint.co/v1/routes/{route_id} \
  -H "Authorization: Bearer $LETTERMINT_TEAM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "track_opens": true,
    "track_clicks": true
  }'

Privacy & Compliance

Lettermint is designed with privacy in mind. Important considerations for GDPR and other privacy regulations:

• Tracking disabled by default - You must explicitly enable tracking per route
• Limited raw signal retention - Raw tracking observations retain exact IP addresses, user agents, and request headers for up to 28 days for classification and abuse analysis, then minimize exact raw signals while preserving IP hashes and classification metadata
• Privacy policy disclosure - Mention email tracking in your privacy policy
• Recipient opt-out - Consider offering recipients a way to opt out of tracked emails
• Marketing consent - For marketing/broadcast emails, ensure you have explicit opt-in consent before enabling tracking

Bot Detection

Not all opens and clicks come from humans. Email security scanners, link preview bots, and privacy proxies can trigger tracking requests. Lettermint keeps security, preview, and generic bot activity out of default engagement data. It reports supported privacy fetches as observed privacy opens without calling them human opens.

Each tracking event includes:

• bot.detected - Boolean indicating if the interaction appears automated
• bot.probability - Confidence score (0-100) for the bot detection
• bot.classification - Stable result category for the tracking request
• bot.proxy_type - Optional source detail. Treat it as an open string
• bot.reason_codes - Opaque diagnostic labels. Do not use them for application decisions
• bot.machine - Whether the event is classified as non-human machine, privacy, or security activity
• bot.counts_for_metrics - Whether the event contributes to human open or click metrics
• bot.counts_for_status - Whether the event can change the message status
• bot.webhook_eligible - Whether the event is eligible for a default webhook
• first_open / first_click - Whether this is the first human-countable engagement
• first_observed_open - Whether this is the first human or supported privacy open observation
• device_type - Device category: desktop, mobile, tablet
• client_type - Client category: browser, email_client, etc.
• client_name - Specific client: Chrome, Safari, Outlook, etc.

Bot Detection Field Values

The bot object uses the same fields for message.opened and message.clicked webhook payloads.

Field	Values	Description
detected	true, false	true when Lettermint detected automated, privacy, preview, scanner, or otherwise suspicious activity.
probability	Integer from 0 to 100	Bot probability score. Higher values are more likely to be automated or non-human activity.
classification	Stable string category	The result category. Use it together with the decision flags.
proxy_type	Open string, or null	Optional source detail. New values can appear.
reason_codes	Open list of strings	Opaque diagnostic labels for troubleshooting. The list can be empty and its values can change.
machine	true, false	true when the request actor is a machine or privacy proxy. Supported privacy opens can still be present in default timelines and webhooks.
counts_for_metrics	true, false	true when the event contributes to human open or click metrics. Privacy opens use separate observed and privacy metrics.
counts_for_status	true, false	true when the event can change the message status.
webhook_eligible	true, false	true when the event is eligible for a default webhook.

Stable Classification Values

The following values are stable. Lettermint can add a new classification value. Keep a safe fallback for values that your integration does not know.

Value	Meaning	Counts for default metrics
genuine	Human-countable open or click.	Yes
image_proxy	Known mailbox image proxy activity that is treated as human-countable engagement.	Yes
privacy_proxy	Privacy relay or delivery prefetch activity. The initial fetch contributes to observed privacy opens, but not human opens. A later high-confidence click can confirm inferred human engagement. The classification stays privacy_proxy.	Observed initially; inferred human after confirmation
security_scanner	Corporate, mailbox, or security scanning activity.	No
link_preview_bot	Link preview generators from chat, social, or messaging apps.	No
generic_bot	Generic crawler, automation, synthetic client, or scripted activity.	No
suspicious	Activity that is not confidently human and is excluded from default engagement metrics.	No
unverified_click	Countable browser-like click with limited supporting context.	Yes

privacy_proxy describes the source of an open. It does not describe the final engagement conclusion. After a high-confidence click, the revised open keeps privacy_proxy, keeps the same tracking_event_id, and changes to revision 2. Use engagement.human_open and engagement.inferred to read the conclusion.

Proxy Type Examples

proxy_type is source detail, not a behavior contract. It is an open string, not a closed enum. The following values are examples. Lettermint can add, change, or stop sending values. Your integration must accept any non-null string.

Value	Meaning
apple_private_relay	Apple relay activity.
proton_mail_proxy	Proton proxy activity.
gmail	Gmail image proxy activity.

A null value means that Lettermint did not assign a known proxy family. Older events can contain legacy values. Do not use proxy_type to decide if an event counts. Use classification and the counts_for_*, webhook_eligible, and machine flags.

Reason Code Guidance

Reason codes are opaque diagnostic labels for troubleshooting and support. Lettermint does not publish a complete catalogue. They are not a stable public enum, and Lettermint can add, remove, rename, or combine them.

Use bot.machine, bot.counts_for_metrics, bot.counts_for_status, bot.webhook_eligible, and bot.classification for behavior decisions. You can store or display proxy_type and reason_codes for diagnostics, but do not use their exact values for customer-facing logic.

See the Open Tracking and Click Tracking pages for detailed bot detection information.

Webhook Events

When human-countable or supported privacy-open events occur, Lettermint sends webhook notifications:

• message.opened - Recipient opened the email
• message.clicked - Recipient clicked a link

Configure webhooks on your route to receive these events. Supported Apple and Proton privacy opens are sent by default. Security scanners, previews, and generic bots require Include machine events. See Webhook Events for payload details.

Viewing Metrics

Track engagement metrics in your dashboard:

1. Navigate to your project
2. View route-level or message-level analytics
3. See open rates, click rates, and engagement over time

The dashboard reports Observed opens as unique human opens plus unique supported privacy opens. It also reports the human and privacy parts separately. Security scanners, previews, and generic bots stay outside this headline.

Limitations

• HTML emails only - Open tracking requires HTML content; plain-text emails cannot be tracked
• Token expiration - Tracking tokens expire after 30 days; events after expiration are not recorded
• Privacy proxies - Apple relay IPs do not identify the exact Apple privacy feature. Lettermint reports them as privacy opens. HEY and Fastmail documented display proxies are likely-human opens.
• Corporate security - Link scanners may pre-click links, though bot detection filters most of these

FAQ

Does tracking affect email deliverability?

Both tracking methods can have minor deliverability implications:

• Click tracking - Rewritten links route through our tracking domain (t.ltrmnt.com). Some aggressive spam filters flag redirect links, though impact is minimal for established senders.
• Open tracking - The 1x1 pixel can trigger image preloading warnings in some clients, particularly Gmail. This may slightly increase spam filter scrutiny.
• Domain reputation - Our tracking domain maintains high deliverability standards to minimize impact.

For critical transactional emails (password resets, 2FA codes), consider keeping tracking disabled to maximize deliverability.

Should I enable tracking for transactional emails?

It depends on your use case:

• Marketing/broadcast emails - Yes, tracking provides valuable engagement metrics
• Order confirmations, receipts - Usually safe to enable
• Password resets, 2FA, security alerts - Consider disabling to ensure maximum deliverability

Use route-level configuration to enable tracking selectively.

Will recipients see the tracking domain in links?

Yes, when hovering over links, recipients will see t.ltrmnt.com instead of your destination URL. This is standard for email tracking. The redirect is instant, so user experience is not affected.

Can I use my own domain for tracking links?

Yes! Custom tracking domains are available on Pro plans. You can use your own subdomain (e.g., track.yourdomain.com) instead of the default tracking domain, providing a more branded experience for your recipients. See Custom Tracking Domains for setup instructions.

Next Steps