Open tracking is not on the list of things Gmail or Outlook say they check. I read both providers' official sender pages in September 2026. Neither page contains the words "tracking pixel" or "tracking domain."
Google's page lists authentication, DNS records, encryption, spam rate, message format and unsubscribe links. Microsoft's covers SPF, DKIM and DMARC for high-volume senders. Those are the three DNS records that prove an email really came from your domain and was not sent by someone impersonating you.
So the popular claim that the pixel gets you flagged has no official source behind it. The evidence for it is vendor blog posts.
There is one documented risk, and it lives in your links, not in the pixel. Domain blocklists check the domains inside a message, and unless you set up your own, a sending tool runs tracking through a domain its customers share.
My answer for cold outreach: switch open tracking off, and if you keep click tracking, run it on your own subdomain. The open number was unreliable anyway.
What a tracking pixel and a tracking link actually do
Open tracking adds a tiny image, usually 1 by 1 pixel, to the HTML of each email. Every recipient gets a unique image address. When their mail app loads images, it requests that address from your sending tool's server, and the tool logs an "open."
Click tracking works differently. The tool rewrites every link in your email so it points to its own server first. The recipient clicks, the server logs the click, then forwards them to the page you meant.
Both run through a domain. By default it belongs to the tool and is shared with its other customers. That detail matters more than the pixel.
What Gmail and Outlook officially say about tracking
Google's email sender guidelines are where Gmail tells senders what it checks (checked September 2026). For every sender: SPF or DKIM authentication, forward and reverse DNS records that resolve, a TLS connection, messages formatted to the RFC 5322 standard, and a spam rate, as Postmaster Tools reports it, under 0.3%. The page sets a stricter target too: stay under 0.10% and never reach 0.30%.
Past 5,000 messages to Gmail accounts in one day, Google treats you as a bulk sender, and you also need DMARC and a From domain aligned with the SPF or DKIM domain. Marketing mail then needs a one-click unsubscribe.
Microsoft's Outlook.com postmaster page says that since May 5, 2025, any domain that sends more than 5,000 emails daily must meet SPF, DKIM and DMARC (checked September 2026). Mail that fails goes to junk, and Microsoft says it will move to rejecting it.
Yahoo's sender best practices page tells the same story a third time (checked September 2026): SPF or DKIM for every sender, both plus a DMARC policy of at least p=none for bulk senders, and complaints kept under 0.3%.
None of the three pages mentions a tracking pixel, a tracking domain or a link redirect.
What the silence proves, and what it does not
These are the pages where the two biggest mailbox providers spell out what a sender has to get right. Google names spam thresholds down to two decimal places. If a pixel were something they wanted senders to fix, this is where it would show up.
The silence does not prove tracking is harmless. Filters weigh plenty of signals no provider publishes, which is one reason placement differs so much between providers, as the seed-test numbers by provider show. What it proves is narrower: anyone who says "Gmail penalizes pixels" is not quoting Gmail.
The closest Google gets is its formatting guidance. It asks for links that "should be visible and easy to understand" and says the people reading "should know what to expect when they click a link." A link that displays your website but routes through a tool's domain sits awkwardly next to that line. That is my reading. Google does not say it.
Gmail's help page on turning images on or off adds one more piece (checked September 2026). Images load automatically by default, Google scans them first, and senders cannot use them to learn the reader's location or computer details. When Gmail judges a message or its sender suspicious, it hides the images and asks the reader.
So suspicion hides the pixel. No Google page I found says the pixel creates the suspicion.
Every popular claim about open tracking, graded
I sorted each claim by the best evidence I could find in September 2026. Three grades:
- Official: the platform that controls the behavior documents it.
- Documented mechanism: a blocklist operator documents how it works, but no published case or data shows it happening to a tracking domain.
- Unsourced: a vendor or practitioner states it without a study, a test or a checkable source.
| Claim | Who repeats it | Best evidence found | Grade |
|---|---|---|---|
| Apple Mail loads your pixel whether or not anyone reads the email | Most pages I read on this topic | Apple's own Mail Privacy Protection page | Official |
| Gmail and Outlook require authentication and a low spam rate | Most pages I read on this topic | Google's and Microsoft's sender pages | Official |
| Gmail or Outlook penalize an email for containing a tracking pixel | Vendor blogs | Not mentioned on either provider's sender page | Unsourced |
| Gmail shows a warning banner because of tracking pixels | Vendor blogs, LinkedIn posts | One vendor dates it to late 2024 with no Google link; Gmail Help says images are hidden once a message is judged suspicious | Unsourced, cause and effect reversed |
| A pixel tells the provider your email is promotional | A software vendor's founder | A timestamp in a video | Unsourced |
| A shared tracking domain can get blocklisted because of other senders | Sending tool vendors | Spamhaus documents checking link domains, including abused redirectors; no named case for a shared tracking domain | Documented mechanism |
| A link domain that differs from the From domain looks like phishing | Agencies and vendors | Google asks for links that are easy to understand; no provider names the mismatch as a signal | Unsourced, loosely supported |
| Turning tracking off lifts inbox placement by a set number of points | Practitioners | No controlled test found | Unsourced |
| A custom tracking domain removes the shared-domain risk | Sending tool vendors | Follows from the blocklist mechanism; no before-and-after data published | Documented mechanism |
The vendor rows come from sellers of cold email tools. Instantly's guide (updated March 2026) says some aggressive spam filters may flag pixels and describes the late-2024 Gmail banner without a Google source. Emailchaser's article, written by the company's founder, sources the "promotional signal" claim to a video. Neither shows a test with tracking on for one group and off for another.
The placement-lift row has one number in circulation. An outbound agency's August 2026 article puts the gain from stripping open tracking off the first touch at "low single digits to around ten points" and itself calls that a rule of thumb.
What it means for a founder: the two official rows are about Apple inflating your opens and about authentication. Neither says the pixel hurts you. The two rows with a documented mechanism are both about domains.
Why the domain inside your links is the real risk
Spamhaus publishes the Domain Blocklist, a list of domains with poor reputation (checked September 2026). Its documentation tells mail filters to check the domains that appear in a message's headers and body, URLs included. It has a separate return code for an "abused spammed redirector domain."
A click-tracking domain is a redirector. That is its whole job.
If one customer of your tool sends spam through the shared tracking domain and that domain gets listed, every email carrying it now contains a listed domain. Yours included. GMass, another sending tool, explained this risk in a November 2022 post and says it watches its customers' tracking domains on three blocklists. It cites no incident.
Here is the same cold email three ways, trimmed to the parts of the raw message a filter reads. The sending domain is a separate cold domain, yourfirm-mail.com.
1. Tool default, shared tracking domain
From: you@yourfirm-mail.com
<img src="https://t.sharedtool.example/o/7Hq2x.gif" width="1" height="1">
<a href="https://t.sharedtool.example/c/7Hq2x/9">yourfirm.com/case-study</a>
2. Custom tracking subdomain
From: you@yourfirm-mail.com
<a href="https://go.yourfirm-mail.com/c/7Hq2x/9">yourfirm.com/case-study</a>
3. No tracking
From: you@yourfirm-mail.com
<a href="https://yourfirm.com/case-study">yourfirm.com/case-study</a>
In version 1 the reader sees your case study address, but the link underneath points at a domain you do not control and share with strangers. In version 2 the redirect runs on a subdomain of your own sending domain, set up with one CNAME record that points to the tool. Version 3 gives a filter nothing to check except domains you own.
One thing people assume and should not: DMARC does not cover this. It checks that your From domain lines up with SPF or DKIM. It says nothing about the domains in your links, so passing authentication does not make a shared tracking domain yours.
Put the tracking subdomain on the cold sending domain, never on the company domain your billing runs on. I explain why cold mail gets its own domains in how I set up sending before the first email.
Is the open rate worth that risk?
Even if the pixel carried zero risk, the number it produces is weak. Apple's Mail Privacy Protection fetches remote content on its own by default, even when nobody engages with the email (checked September 2026). Its stated purpose is to stop senders learning when and how many times a message was opened.
For every reader on Apple Mail with that switched on, your "open" is Apple fetching an image.
So the trade is lopsided. You carry a small, unmeasured risk in your link domain to collect a metric that partly counts machines. What that does to send-time data is covered in the post on the best time to send cold email.
Watch two groups of numbers instead. On the sending side: inbox placement from a seed test, bounce rate and your Postmaster Tools spam rate, the last two of which a weekly sender reputation check covers. On the result side: sales calls booked and calls actually held, counted separately, then the replies behind them and how many of those were positive.
Check your follow-up logic too. If the sequence sends a different second email to people it believes opened the first, that split is mostly noise. An Apple Mail reader who never looked at the message lands in the "interested" path, and a reader whose mail app blocks images lands in the other one. Send everyone the same follow-up on a fixed schedule, and let a reply be the only thing that changes someone's path.
What to switch on and off
| Setting | Cold first touch | Cold follow-ups | Email to people who opted in |
|---|---|---|---|
| Open tracking | Off | Off | Optional, read opens as a rough trend |
| Click tracking | Off, unless clicks are the one thing you measure | Off | On, if you use the data |
| Tracking domain, if anything stays on | Custom subdomain of the sending domain | Same | Same |
| Links to your site | Plain, direct links | Plain, direct links | Plain or tracked |
The rule behind the table: with tracking off you lose a number you could not trust and remove the one risk with a documented mechanism. If you keep tracking, the custom subdomain costs one DNS record and takes the shared domain out of your emails.
What switching tracking off will not do is rescue a domain that fails authentication, a list full of bounces or a spam rate above 0.3%. Those are the written rules, and they fail you with or without a pixel.
Authentication first, then argue about pixels
If I had to keep one rule from this whole topic, it would be this one: "Set up SPF, DKIM and DMARC before sending at any volume." It is the part Google and Microsoft actually wrote down.
Smirnov Consulting Group is a Prague-based B2B outbound lead generation agency that runs cold email and LinkedIn campaigns for founder-led B2B companies and books qualified sales calls.
From that seat, this is how I read the provider pages. They publish the gate: the minimum your mail has to meet, and what happens when it does not. Google says non-compliant mail might be marked as spam. Microsoft sends failing mail to junk and says it will move to rejecting it. What neither publishes is the rest of what a filter weighs once your mail is through that gate.
Tracking, if it matters at all, sits in that unpublished part. So fix the gate first, where the rules are written and you can check them in an afternoon. Then make the cheap moves on the unwritten side: your own domain in your links, and no metric you cannot trust.
FAQ
Does Gmail flag emails with tracking pixels as spam?
Gmail's sender guidelines and its image help page do not say so (checked September 2026). Gmail hides images when it already judges a sender or message suspicious, which is likely where the "pixel warning" story comes from. No Google page I found says a pixel causes that judgment.
Do I need a custom tracking domain for cold email?
Only if you keep open or click tracking on. Then yes. One CNAME record on a subdomain of your sending domain takes your links off a domain shared with other senders, which is the one tracking risk with a documented mechanism behind it.
Will turning off open tracking fix my deliverability?
Not on its own. If your mail lands in spam, check authentication, bounce rate and spam rate first, because those are the rules providers publish. Removing tracking takes away a small, unmeasured risk and nothing more.