Identify Non-Human Email Interactions at Scale

Because a large share of those opens were never read by a person. Since Apple Mail Privacy Protection launched with iOS 15, Apple pre-loads the tracking pixel in every message it delivers, whether or not the recipient opens it, and corporate security gateways do the same thing when they scan a message. Around 50% of the B2C opens Omnivery measures are non-human. The industry term for this is Non-Human Interactions, or NHI, and an open rate is the sum of real readers and NHI with no way to tell them apart until each event is classified.

Bot clicks are link clicks recorded in your reporting that no person made. Most come from security software following every link in a message to check it for malware or phishing before the recipient ever sees it. Dozens of vendors do this rather than a handful: enterprise gateways such as Mimecast, Proofpoint, Barracuda and Microsoft Defender are the most recognizable, and Gmail, Yahoo and effectively every large consumer mailbox provider scan links too, so it is not an enterprise-only problem. A smaller share is deliberate fraud, such as botnets clicking newsletter ads to inflate advertiser billing. The industry term covering both is Non-Human Interactions (NHI). Omnivery measures B2C bot clicks at about 16% in 2026, up from about 2% in 2023.

You do not, and you should not try. The largest source is security infrastructure that your recipients' own employers pay for, so blocking it means your mail stops being delivered. The workable approach is classification rather than prevention: identify which interactions were non-human, then keep them out of the metrics, list hygiene decisions and automation triggers that would otherwise act on them. That is what the Bot Detection API does. It applies no blocking, no CAPTCHAs and no suppression.

Some of them. In B2C sending, roughly half the opens Omnivery measures are non-human, and have been since Apple Mail Privacy Protection launched. In B2B the share varies much more widely, because it depends on the security stack sitting in front of each recipient. An open rate on its own cannot tell you which is which. Classifying Non-Human Interactions (NHI) per event is what separates the two, and clicks need the same treatment as opens, for different reasons.

A Non-Human Interaction is an email open or click generated by software rather than by the recipient. The main sources are corporate security gateways scanning links for malware and phishing, Apple Mail Privacy Protection pre-loading tracking pixels, inbox tracking and deliverability testing tools, and malicious botnets. NHI is the term established by the M3AAWG Senders Committee and now in industry-wide use. Marketers usually describe the same thing as bot opens and bot clicks.

Web bot traffic means an adversary probing a website, and web bot detection exists to block or challenge it. NHI differs in origin and in what you should do about it: most of it comes from legitimate security vendors performing a service the recipient's employer paid for, so it cannot be blocked, and the correct response is accurate classification. This is also why generic web bot detection misclassifies email engagement. It is built to reason about intent and act on it, and applied to email that framing is wrong from the start.

Because bot implies abuse, and most of this traffic is not abusive. It is security software checking links. The term was settled in the M3AAWG Senders Committee, and Omnivery's founder was part of the group that produced the Non-Human Interactions white paper and argued for Non-Human Interactions over bots on the grounds that most such traffic originates from legitimate security vendors rather than from abuse. The document is Exploring the Impact of Nonhuman Interactions on Email Send Metrics, M3AAWG-136, published November 2020.

Yes. Apple MPP routes opens through Apple's proxy infrastructure and pre-loads tracking pixels whether or not the recipient reads the message, so the resulting open was generated by software rather than by a person. It is the single largest source of non-human opens in B2C sending, accounting for more than 95% of the non-human opens Omnivery identifies there. MPP affects opens only. Non-human clicks come from security scanners, tracking tools and botnets instead.

A boolean is_bot field per event - true if non-human, false if likely human. Response also returns all originally submitted fields so you can match by event_id.

Yes, provided raw tracking events are available with source IP and user agent per interaction. If your ESP aggregates, proxies, or omits these fields, integration is not technically possible.

Optional but improves detection. Hidden link only bots follow. IP and UA cached for 30 minutes. Any subsequent matching event within the window is flagged immediately. One line of HTML to implement.

Yes. Apple MPP routes opens through Apple's proxy infrastructure with a known IP range and user agent pattern. These are identified and flagged.

Yes. POST events with webhook_url, receive 202 Accepted with batch_id, results pushed to webhook when complete. Can also retrieve individual results by request_id.

Minimum response time of over one second, rate limited. Prevents use as real-time classifier which would expose detection model to enumeration attacks. For volume use, use the batch endpoint.

Contact sales@omnivery.com. Access requires domain enablement and brief technical review of tracking data pipeline.

Designed with privacy in mind. recipient_id is recommended hashed. IPs and UAs not permanently stored associated with identifiable individuals. EU headquarters, GDPR-native architecture. DPA available at omnivery.com/legal/dpa.