Can I tell whether the recipient opened or read the email?¶
title: Can I tell whether the recipient opened or read the email? subtitle: Delivery, opening, remote-content loading and human reading are different events. slug: can-i-tell-whether-the-recipient-opened-or-read-the-email series: email-evidence section: evidential-limits-and-corroboration card_type: question_card pathway_order: 38 section_order: 4 status: draft public_safe: true video_ready: true word_count: 589 estimated_read_time_seconds: 244 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - read receipt - tracking pixel - mailbox access - evidential limits sources: - title: 'RFC 8098: Message Disposition Notification' url: https://www.rfc-editor.org/info/rfc8098/ - title: 'Gmail Help: Request or return a read receipt' url: https://support.google.com/mail/answer/9413651?hl=en-GB - title: 'Microsoft Support: Add and request read receipts and delivery notifications' url: https://support.microsoft.com/en-us/office/add-and-request-read-receipts-and-delivery-notifications-in-outlook-a34bf70a-4c2c-4461-b2a1-12e4a7a92141 - title: 'Microsoft Learn: Audit log activities' url: https://learn.microsoft.com/en-us/purview/audit-log-activities
Can I tell whether the recipient opened or read the email?¶
Delivery, opening, remote-content loading and human reading are different events.
Script¶
You need to know whether the recipient opened or read an email.
That sounds like one question.
It is actually several.
Was the message delivered to the mailbox?
Was it displayed by an email application?
Was remote content fetched?
Was the mailbox item marked as read?
Did a particular person see it?
And did they actually read and understand the content?
Different records answer different parts of that sequence.
Start with delivery.
A provider message trace or delivery receipt may support that the receiving system accepted the message or placed it in a mailbox.
That doesn’t prove that the recipient opened it.
A read receipt is different.
Some email systems allow the sender to request a Message Disposition Notification, often described as a read receipt.
The recipient may be asked whether to send it.
Their organisation may allow, restrict or automate the response.
Their email application may not support it.
A message may also be marked as read without being opened in the way most people imagine.
Google’s own guidance warns that a receipt doesn’t always mean the person read the message. An IMAP client may mark it as read, while some systems may return no receipt at all.
So a read receipt is evidence of a system or user action associated with the message.
It isn’t a guaranteed record of human attention.
Tracking pixels create another type of evidence.
The HTML message may contain a unique remote image. When something requests that image, the sender’s platform may record an “open”.
But the request may have been made by the recipient’s provider, a privacy relay, a security scanner, a preview service or another user of the mailbox.
The person may never have read the words.
The reverse is also possible.
The recipient may read the message with remote images blocked, leaving no tracking event.
Mailbox audit can sometimes provide stronger organisational evidence.
A provider may record that a particular message was accessed, synchronised, opened in a preview pane or bound by a mail client.
The exact event and availability depend on the platform, licence, configuration and access method.
An access record still needs interpretation.
A shared mailbox may have several users.
A mobile application may synchronise messages automatically.
A delegate or administrator may open the item.
A preview pane may display it briefly.
The account may already have been compromised.
If the question matters, build the evidence in layers.
Confirm delivery through the provider.
Preserve any read or disposition receipt.
Preserve the tracking-pixel URL and sender-side tracking record.
Obtain mailbox audit or message-access records where available.
Identify the account, user, session, application and device connected to the access event.
Then look for human corroboration.
Did the recipient reply?
Did they act on instructions found only in the message?
Did they mention its contents elsewhere?
Was an attachment opened or a link followed?
Did later behaviour show knowledge of the message?
The common mistake is:
“The system says opened, so the recipient definitely read it.”
The opposite mistake is:
“There is no read receipt, so the recipient never saw it.”
Neither is safe.
A careful conclusion might be:
“The provider recorded delivery. A read receipt was returned at this time, and the mailbox audit records access to the message through this account and application.”
Then explain what links that account activity to the person.
Email systems can record delivery, display, access and remote-content requests.
They can’t reliably record whether a human paid attention, understood the message or remembers reading it.
That final step usually needs context outside the technical record.
Key takeaway
A receipt, tracking event or mailbox-access record may support that the message was processed or displayed. It rarely proves that a particular person read and understood it.
Related questions¶
- What is a tracking pixel?
- What can embedded images reveal?
- What account-access records may exist?
- What corroboration should I look for?
Source notes¶
- RFC 8098: Message Disposition Notification
- Gmail Help: Request or return a read receipt
- Microsoft Support: Add and request read receipts and delivery notifications
- Microsoft Learn: Audit log activities