Link tracking tells senders when a recipient opens a protected email or clicks one of its attachment links. It works with Protect Attachments and Secure Email rules. This page explains what is tracked, how to turn it on in a rule, what the sender receives, and how to exclude your own security systems so they don't trigger false notifications.
Before you begin
- Tracking is available on Protect Attachments and Secure Email rules with the Email Flow target.
- The sender must be in your organization. Tracking applies when the rule direction is Between, or the sender is managed by the rule.
- Tell your users about tracking, and check that it fits your privacy policy and local law. Tracking records the IP-based location and device of the person who opens or clicks.
What is tracked
| Event | How it's detected |
|---|---|
| Email opened | A small invisible image in the email is loaded when the recipient views it. |
| Link clicked | The recipient clicks an attachment link (or folder link) that mxHERO added. The click goes through mxHERO's tracking service, then on to the file. |
For each event, mxHERO records the time, the approximate location (from the IP address) and the device and browser.
Things to know:
- Opens are not exact. Many email apps block images by default, so an open may not be recorded. Some security systems and image proxies load images automatically, which can look like an open.
- Known bots and link scanners are ignored for notifications. Link previews from apps such as Slack, Discord, WhatsApp and Telegram, image proxies, and web crawlers are recorded without location and never trigger a notification.
- Repeated opens from the same IP address and device within 30 minutes count once.
- Location is approximate. It's based on the IP address of the person who clicked, which may be a VPN, proxy or mobile carrier.
- Tracking stops after 30 days. Links keep working after that, but no more events are recorded.
Turn on tracking in a rule
Open the Protect Attachments or Secure Email rule (Rules › Rules List › Edit), or create one.
In the Cloud Storage step, open Advanced Options.
-
Set Tracking option: to one of:
Option Tracks Do not track emails Nothing (default) Track email opens Opens only Track only attachment access Link and file clicks only Track email opens and attachment access Opens and clicks Click Confirm, then save the rule.
What the sender receives
When a tracked event happens, the sender gets a Tracking Notification email from noreply@mxhero.com:
- It is sent as a reply to the original email, with the same subject.
- It says which file was accessed, or that the email was opened, and by which recipient (for example, "invoice.pdf was accessed from email sent to jane.doe@example.com").
- It includes an Open tracking report button, unless you turned the report off (see below). The report, at
tracking.mxhero.com, lists each access with time, location and device. It is shown in English or Japanese, based on the browser language. - It includes a link to stop notifications for that email for 29 days.
To avoid flooding the sender, at most one notification is sent for each email, recipient and event type (and each link) within 21 days.
Organization settings
Open Settings › Integrations and select the Storage settings tab.
| Setting | Effect |
|---|---|
| Tracking report disabled | Removes the Open tracking report button from tracking notifications. Senders still get the notification, without location and device details. |
| Email Tracking Exclusions › Hostnames | Opens and clicks from these hosts are not recorded and don't notify the sender. |
| Email Tracking Exclusions › Ip Masks | Opens and clicks from these IP addresses are not recorded and don't notify the sender. |
Exclude your own security systems
Email security gateways, link scanners and sandboxes often open emails and click links before the recipient does. Exclude them so senders don't get false notifications.
Hostname exclusions
mxHERO looks up the hostname of the IP address that opened or clicked (reverse DNS) and compares it with your list.
- Enter the full, exact hostname, for example
scanner01.mail.example.com. - Don't use wildcards such as
*.example.com. - To find the hostname, run a reverse lookup on the scanner's IP address, for example
nslookup 203.0.113.10.
IP exclusions
Enter the IP addresses of the systems to exclude.
Important: Prefer hostname exclusions where your scanners have stable reverse-DNS names, and always test an exclusion after you add it (see Verify).
Verify
- Send a test email through the tracked rule to an external mailbox you control.
- Open the email and click an attachment link.
- Check that the sender receives a Tracking Notification, and that Open tracking report shows the access.
- To test an exclusion, repeat from the excluded system (or ask your security team to trigger a scan). No notification should arrive, and the report should not list that access.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| No notifications at all | Tracking option: is Do not track emails, the rule isn't Protect Attachments or Secure Email on Email Flow, or the sender isn't in your organization | Check the rule's Tracking option: and direction. |
| Opens never reported | The recipient's email app blocks images | Expected. Use Track only attachment access or Track email opens and attachment access for more reliable results. |
| Sender notified within seconds of sending | A security scanner opened the email or clicked the link | Add the scanner's hostname to the exclusions. |
| Exclusion doesn't seem to work | Hostname isn't an exact match of the reverse-DNS name, or a wildcard was used | Enter the exact hostname from a reverse lookup. Contact support if IP exclusions don't take effect. |
| No Open tracking report button | The tracking report is disabled in Storage settings | Turn the setting off if senders need the report. |
| Location looks wrong | Location is estimated from the IP address | Expected; treat location as approximate. |
Comments
0 comments
Please sign in to leave a comment.