Read receipts, the polite kind, ask permission. The other kind does not ask, is in most commercial mail you receive, and is built out of nothing more exotic than an image.
What it actually is
An ordinary image tag: <img src="https://t.example-crm.com/o/8f2c9a41.gif">. Often one pixel, transparent, sitting at the bottom of the message where nobody looks. There is nothing in the format that marks it as tracking, and nothing that needs to be — the logo at the top of the newsletter does the same job.
The trick is not the picture. It is the address. The same transparent dot is served to everybody, from a URL that is unique per recipient, so a request for that particular path means that particular copy of that particular message was displayed. The identifier is in the link, not the image.
What the request reports
When your mail client fetches it, the server at the other end records the ordinary details of any web request, which in this context amount to:
That the message was displayed, and when — to the second, on the sender's clock.
Your IP address, which is an approximate location, usually correct to the city and sometimes only to the country. It also identifies the network. Reading a message at work from a company address tells the sender who you work for even if your mail address does not.
Your user agent — the mail client, its version, the operating system, often the kind of device.
How many times. Each display is another request, so the log becomes “opened six times over two days”. Forwarding does not reset it: the forwarded copy still carries the URL issued to you, so the opens of whoever you sent it to are counted against your identifier.
What it does not report is anything about you beyond that. It does not read your mailbox, it does not know whether you read the message or deleted it after a glance, and it cannot tell an open from a preview pane. It is one fact, repeated.
Why every client now asks first
Blocked by default, with a banner offering to load the pictures. Outlook has behaved this way since 2003, and Apple Mail, Thunderbird and the rest followed.
The reason is that there is no partial version of this. A client cannot fetch the image and decline to make the request; the request is the fetch. So the only point at which anyone can decide is before it happens, and the banner is that decision handed to you.
The cost is that ordinary mail looks broken — product photographs, letterheads, the layout of a receipt. Every client accepted that cost, which tells you how one-sided the trade was judged to be.
Gmail's proxy, and its limits
Since 2013 Gmail shows images by default again, because it stopped fetching them from your machine. Google requests them from its own servers and hands you a copy.
What that hides: your IP address and your client. The sender's log shows a Google data centre and a Google user agent, so the location and the device are gone.
What it does not do: stop the open being recorded. The address requested is still the one issued to you alone, and it is still requested when the message is displayed. The sender loses where you are and keeps that you looked and roughly when.
Caching softens the second half. Google keeps its copy, so a later display may not produce a later fetch, which makes the repeat-open figures unreliable rather than absent.
Apple went further in 2021: Mail Privacy Protection fetches remote content for messages whether or not you open them, through a proxy. The sender receives an open for everything, which is not anonymity but noise — the signal is not hidden, it is wrong. Open rates reported by mailing tools have been difficult to read since.
Plain text cannot do this
Most commercial mail is sent twice in the same message: a plain-text version and an HTML version, and the client picks. The plain-text part has no image tags because the format has no images. There is nothing in it to fetch, and nothing to report.
So reading the text part is immunity rather than caution. Many clients can be told to prefer it, and if you have the file in hand you can pull the text out and read that instead.
One qualification: links are still links. Clicking one in a marketing message usually passes through a redirect carrying the same identifier, and that is a louder signal than an open. Not loading the pictures does not make the message inert.
Which brings us to online converters
An online viewer that renders a message renders the image tag with it. Uploading an .eml to a site that displays it, or turns it into a PDF, means a browser in a data centre requesting every remote image in the file.
The receipt fires. It fires from an address you have never been at, at a time you did not choose, and it tells the sender the message was handled. If the sender is a stranger, a recruiter, or the other side of a dispute, that is a disclosure made by a tool you picked for convenience.
This is separate from the message itself sitting on somebody's server, which is the larger problem with the same workflow.
The viewer here does not fetch remote content. It reads the file, shows the headers, the body and the list of attachments, and leaves anything hosted elsewhere unrequested. What is genuinely inside the file needs no request to read, which is most of what you wanted anyway.
How to check a message you already have
Look at the HTML. An image whose host is not the sender's domain, with a long random path, is a tracker; so is one declared at one pixel by one, or hidden with a display style. Marketing platforms tend to name themselves in the hostname, which makes them easy to spot.
Remote images are not automatically sinister — a hosted logo keeps the message small, and that is why the technique exists at all. The question is only ever who learns what, and when.
The short version
A tracking pixel is an image tag with your name in the URL. Fetching it reports the open, the time, your address and your client, and it counts every repeat. Blocking remote content stops all of it; Gmail's proxy stops the location and not the open; plain text has nothing to fetch. And any tool that renders the message on a server sends the receipt on your behalf, which is worth knowing before you upload one.