<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <title>DEV Community: Yixiu Liu</title>
    <description>The latest articles on DEV Community by Yixiu Liu (@hyehugh).</description>
    <link>https://dev.to/hyehugh</link>
    <image>
      <url>https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4200419%2F36c51d72-e41d-4aa3-95a3-92abfee61b9a.png</url>
      <title>DEV Community: Yixiu Liu</title>
      <link>https://dev.to/hyehugh</link>
    </image>
    <atom:link rel="self" type="application/rss+xml" href="https://dev.to/feed/hyehugh"/>
    <language>en</language>
    <item>
      <title>Your open rate is inflated by three machines - here is how to prove it</title>
      <dc:creator>Yixiu Liu</dc:creator>
      <pubDate>Thu, 22 Oct 2026 12:09:52 +0000</pubDate>
      <link>https://dev.to/hyehugh/your-open-rate-is-inflated-by-three-machines-here-is-how-to-prove-it-d25</link>
      <guid>https://dev.to/hyehugh/your-open-rate-is-inflated-by-three-machines-here-is-how-to-prove-it-d25</guid>
      <description>&lt;p&gt;If your cold email dashboard shows 50-70% opens, run this audit before you report it to anyone. Three machines fetch the tracking pixel on behalf of your recipient, and a naive counter calls all of them an "open".&lt;/p&gt;

&lt;h2&gt;
  
  
  1. Apple Mail Privacy Protection
&lt;/h2&gt;

&lt;p&gt;Since iOS 15, Apple Mail pre-fetches remote images for users who enable MPP, whether or not the message is ever read. The fetch comes from Apple's proxy, so it looks like a normal image load.&lt;/p&gt;

&lt;h2&gt;
  
  
  2. Gmail's image proxy
&lt;/h2&gt;

&lt;p&gt;Gmail rewrites image URLs through &lt;code&gt;googleusercontent.com&lt;/code&gt; and fetches them itself. Two reliable tells:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;A frozen user agent: &lt;code&gt;Chrome/42.0.2311.135 ... Edge/12.246&lt;/code&gt; - a browser combination that has not existed in years. It does &lt;strong&gt;not&lt;/strong&gt; contain the string &lt;code&gt;GoogleImageProxy&lt;/code&gt;, which is why classifiers that only look for that token miscount it.&lt;/li&gt;
&lt;li&gt;Google egress ranges: &lt;code&gt;66.249.&lt;/code&gt;, &lt;code&gt;66.102.&lt;/code&gt;, &lt;code&gt;64.233.&lt;/code&gt;, &lt;code&gt;209.85.&lt;/code&gt;
&lt;/li&gt;
&lt;/ul&gt;

&lt;h2&gt;
  
  
  3. Corporate security scanners
&lt;/h2&gt;

&lt;p&gt;Microsoft 365 with Defender, Barracuda, Mimecast, Proofpoint and friends detonate or rewrite every URL in an inbound message, images included. A scanner in Frankfurt "opens" your email before the recipient's laptop is awake.&lt;/p&gt;

&lt;h2&gt;
  
  
  The ten-minute audit
&lt;/h2&gt;

&lt;p&gt;Export the raw events from your sending tool - not the summary, the per-event log with IP and user agent - then check four things:&lt;/p&gt;

&lt;div class="table-wrapper-paragraph"&gt;&lt;table&gt;
&lt;thead&gt;
&lt;tr&gt;
&lt;th&gt;Check&lt;/th&gt;
&lt;th&gt;What a machine hit looks like&lt;/th&gt;
&lt;/tr&gt;
&lt;/thead&gt;
&lt;tbody&gt;
&lt;tr&gt;
&lt;td&gt;Repeated hits from one IP&lt;/td&gt;
&lt;td&gt;Same IP loading the pixel 4-10 times within a minute&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;User agent&lt;/td&gt;
&lt;td&gt;datacenter strings, the frozen Chrome 42 / Edge 12 pattern, &lt;code&gt;python-requests&lt;/code&gt;
&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Timing&lt;/td&gt;
&lt;td&gt;machine fetches land in a tight band right after send; humans spread across days&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;IP ownership&lt;/td&gt;
&lt;td&gt;Google, Apple, Microsoft or a security vendor instead of a residential ISP&lt;/td&gt;
&lt;/tr&gt;
&lt;/tbody&gt;
&lt;/table&gt;&lt;/div&gt;

&lt;p&gt;On our own sends the naive number was 61% and the human-only number was 34%. The click rate barely moved between the two definitions, which tells you which metric was real all along.&lt;/p&gt;

&lt;h2&gt;
  
  
  What to measure instead
&lt;/h2&gt;

&lt;ul&gt;
&lt;li&gt;Replies per 100 sends - a proxy cannot fake these&lt;/li&gt;
&lt;li&gt;Human opens, defined explicitly and de-duplicated per recipient&lt;/li&gt;
&lt;li&gt;Bounce and complaint rates for deliverability work&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;The uncomfortable part: honest tracking makes your numbers look worse than the competition's. If a vendor shows 60% where you measure 34%, the vendor is not better at email - it is counting prefetches.&lt;/p&gt;




&lt;p&gt;&lt;em&gt;Originally published at &lt;a href="https://pay.trytoolboxpro.com/blog/why-gmail-open-rates-are-inflated" rel="noopener noreferrer"&gt;pay.trytoolboxpro.com&lt;/a&gt;. I build a Gmail outreach tool that classifies opens this way; the audit above works whether or not you use it.&lt;/em&gt;&lt;/p&gt;

</description>
      <category>analytics</category>
      <category>privacy</category>
      <category>security</category>
    </item>
  </channel>
</rss>
