A growing share of email "opens" are not people. Apple Mail Privacy Protection prefetches images, Gmail proxies them, and corporate security gateways scan every link before the recipient ever sees the message. Lumail classifies each open and click so you can tell real engagement from automated noise.

![One delivered email can record several opens: a security gateway, Apple Mail privacy, and the Gmail image proxy each trigger the tracking pixel before the subscriber reads the email](/docs/bot-detection/tracking-journey.svg)

## What gets classified

Every tracked open and click is evaluated at the moment it is recorded:

- **Human**: the event was evaluated and showed no automation signal.
- **Bot**: the event matched one of the detection rules below.
- **Not evaluated** (clicks only): the click was recorded before click classification rolled out on September 6, 2026. Historical clicks are never re-evaluated.

Classification is **informational**: it never changes your unique open and click counts, your open rate, click rate, or engagement score. A bot open still counts as an open. Instead, Lumail shows you alongside those numbers how much of them you can trust.

![Clicks have three possible labels: clicks recorded before the September 6, 2026 rollout stay "not evaluated"; newer clicks are either human (no automation signal) or bot (automation detected)](/docs/bot-detection/click-classification.svg)

## Detection reasons

When an open or click is flagged as automated, Lumail records why:

| Reason               | What it means                                                                                                        |
| -------------------- | -------------------------------------------------------------------------------------------------------------------- |
| **Apple Mail**       | Apple Mail Privacy Protection prefetched the tracking pixel on Apple's servers, whether or not the email was read     |
| **Gmail Proxy**      | Gmail's image proxy fetched the pixel on Google's infrastructure                                                      |
| **Security Scanner** | An email gateway (Yahoo, Outlook, Barracuda, and similar) scanned the message before delivery to the inbox            |
| **Fast Open**        | The email was opened within 2 minutes of authenticated delivery, faster than a human realistically reads a new email  |
| **Bot**              | The same email was opened from several different browser identities, a pattern typical of impersonation bots          |
| **Crawler**          | The user agent explicitly identified itself as automation or a crawler                                                |

Detection is best-effort. Some bots hide behind residential IPs and realistic user agents, and some fast human readers can be flagged. Treat the split as a strong signal, not an exact count.

Here is how the split reads on a concrete campaign:

![Example with 1,000 emails sent: 450 opened for a 45% open rate, of which 280 are human opens (28% human open rate) and 170 are bot opens (38% of all opens), flagged mostly as Apple Mail privacy, security scanners, fast opens, and the Gmail image proxy](/docs/bot-detection/open-rate-composition.svg)

## How "first open" is classified

Unique opens count the **first interaction per email**. The human/bot label describes that earliest recorded event:

![Two timelines: in scenario A a security scanner opens at 09:00 so the first open is a bot open and the subscriber's 10:12 open is a re-open; in scenario B the subscriber opens at 08:47 so the first open is human and the 09:05 Apple Mail prefetch is a re-open](/docs/bot-detection/first-open-classification.svg)

- If a security scanner opened the email first and the recipient opened it an hour later, the first open is a **bot open** and the recipient's open is a re-open.
- If the recipient opened first, the first open is **human** even if bots fetch the pixel later.

This is why a list with heavy Apple Mail usage can show a high open rate but a much lower human open rate.

## Where you see the split

- **Campaign report**: the Engagement card shows how many first opens were flagged as automated, with a badge per detection reason.
- **Email detail**: each email's open breakdown separates first human opens, first bot opens, and re-opens.
- **Campaign Activity chart**: opens and clicks over time are split into human, bot, and (for clicks) not evaluated.
- **Dashboard**: the Email Engagement card footer summarizes opens flagged as automated and the human / bot / not evaluated click split for the selected period.

## What to do with it

1. **Judge campaigns on human opens and clicks.** If 40% of your opens are Apple Mail prefetches, a "great" open rate may hide a flat one.
2. **Prefer clicks over opens for decisions.** A human click is the strongest engagement signal Lumail tracks; bot clicks from link scanners are filtered out of the human count.
3. **Don't panic about bot opens.** They are a property of your audience's email clients, not a deliverability problem. A B2B list behind corporate gateways will always show security-scanner opens.
4. **Watch the trend, not the absolute number.** A sudden spike in bot opens with no matching sends can indicate list-quality issues or a scanner replaying old links.

## Related Documentation

- [Email Engagement Score](/docs/features/engagement-score) - How open and click rates build your score
- [Deliverability Score](/docs/features/deliverability-score) - Monitor sender reputation
- [Subscriber Events](/docs/features/subscriber-events) - View open and click events in timeline