Click tracking
Rewrite links to record which ones recipients follow, when it is worth doing, and the trust it costs you to turn on.
Updated
Send with track_clicks and every http(s) link in the HTML body is rewritten
to pass through us before reaching its destination.
{
"from": "Acme <hello@mail.yourdomain.com>",
"to": ["customer@example.com"],
"subject": "This month at Acme",
"html": "<p><a href=\"https://yourdomain.com/pricing\">See pricing</a></p>",
"track_clicks": true
}The message page then shows which links were followed and how often, and
email.clicked fires on your webhooks.
Recipients see our hostname
A rewritten link shows our domain when someone hovers it, not yours. That costs the message a little trust, and occasionally trips a spam filter that dislikes redirectors. It is a separate switch from open tracking for exactly this reason — decide it per message, or set an account default in Settings → Sending defaults.
What is left alone
mailto:, tel:, in-page anchors and anything that isn't http or https.
So are links that already point at us — including the unsubscribe link, because
routing an unsubscribe through a click recorder means a mail scanner registers
a click on its way to unsubscribing somebody.
Rewriting is applied to the copy that goes on the wire, never to the body we store. The dashboard preview shows what you wrote.
The link cannot be repointed
The destination is signed into the link, not just carried in it. A tracked URL
whose u parameter has been changed does not verify and is refused — no
redirect is issued.
That matters more than it sounds. Without it, every tracked link is an open
redirect on a domain your DKIM signs: an attacker could send …/api/c/<token>?u=https://phishing.example and it would carry your reputation. Swapping the
destination fails the signature instead.
Scanners
Corporate mail filters follow every link in a message to see where it leads, and they do it more aggressively than they load images. Those are recorded as events but excluded from the count, so a click means one we believe a person performed.
As with opens, this is a floor. A recipient who copies the link, or reads in a client that strips HTML, leaves no trace.
Turning it off
track_clicks: false on a send overrides an account default. A message whose
tracking is cleared after sending stops recording — but its links keep working,
because the redirect happens whether or not we write anything down.