Guide
Email platforms mark some non-human opens or clicks in their data, and each stops at a different point. This guide summarizes what the documentation of Mailgun, SendGrid, SparkPost (now Bird), Amazon SES and nine marketing and engagement platforms says, which field or setting to look for, and what the documentation does not say. The industry term for these opens and clicks is Non-Human Interactions (NHI). Documentation was read on October 19, 2026 and changes, so check the linked pages before you rely on a detail. Omnivery does this classification on the opens and clicks it tracks, and as an API for data tracked elsewhere.
By Omnivery. Published October 2026. Last reviewed October 2026
Usually only in part. Security software follows links and mailbox privacy features load tracking pixels before anyone reads a message, and both show up in your platform's open and click events. Platforms differ in what they mark, which events carry the mark, and whether the reports you see in the dashboard already leave those events out. A field in the event data is a label. It does not remove anything from a report unless the documentation says so.
Our page about bot clicks and bot opens explains where this traffic comes from. This guide covers what sixteen platforms say about it. Every statement below about a platform is taken from that platform's documentation, and where the documentation is silent we say it is not documented.
Four email infrastructure providers, as documented on the pages linked in the sources, read October 19, 2026. The Omnivery row is our own product. "Not documented" means the pages we read do not say, not that the platform lacks the feature.
| Platform | Opens | Clicks | Setting and default |
|---|---|---|---|
| Mailgun | Flagged in the event data (client-info.bot: apple, gmail or generic) | Flagged in the event data, same field | Not documented |
| SendGrid | Apple Mail Privacy Protection opens flagged (sg_machine_open) | Not filtered or flagged, according to its support article | Not documented |
| SparkPost (Bird) | Prefetched opens flagged (is_prefetched); dashboard open rate counts non-prefetched opens | No flag documented; the documentation notes that link scanners can generate clicks | Not documented |
| Amazon SES | Flagged Likely or Unlikely (isBotEvent) | Flagged Likely or Unlikely, same field | No configuration needed if you already publish open or click events |
| Omnivery | Per-event verdict on tracked opens | Per-event verdict on tracked clicks | Included automatically for Omnivery tracking, at no additional charge |
The same questions for twelve more platforms, from the pages linked in the sources, read October 19, 2026. "Not documented" means the pages we read do not say, not that the platform lacks the feature.
| Platform | Opens | Clicks | Setting and default |
|---|---|---|---|
| Mailchimp | Apple Mail Privacy Protection opens can be hidden from reports | Bot clicks hidden from reports; filtered data for email clicks goes back to August 10, 2025 | On by default; toggles in analytics settings; filter_bots API parameter defaults to false |
| Klaviyo | Apple Privacy Open property on open events; documents that human and automated opens cannot be told apart when Apple MPP is on | Bot Click property on click events | Bot clicks excluded from reporting and attribution by default for new accounts; history updated back to January 1, 2022 |
| HubSpot | Bot activity, including security scanners and Apple MPP, filtered from marketing email analytics | Not stated separately | On by default; Email Bot filtering switch in tracking settings; API events carry a filteredEvent flag |
| Brevo | Apple MPP opens reported as proxy_open events | Bot activity detected using IP filtering and behavioral analysis | Included in open metrics by default; settings exclude Apple MPP opens and bot activity |
| ActiveCampaign | BotSense filters bot opens (not Apple MPP) from reporting, segments and automations; Apple MPP opens are handled per report | BotSense filters bot clicks from reporting, segments and automations | Not filtered by default; applies going forward only; Pro and Enterprise plans |
| Iterable | isBot field on open events feeds filtered open metrics | isBot in click event payloads; filtered metrics exclude likely automated clicks | No setting documented; Iterable calls isBot a heuristic |
| Mailjet | Bot activity removed from campaign stats | Bot activity removed from campaign stats | Removed by default, and you can choose to include it; no bot field documented in webhook events |
| Campaign Monitor | No filter documented; documents that Apple MPP can artificially increase open rates | Non-human click filter removes non-human clicks from reports | Paid add-on on Essentials/Unlimited or Premier plans, per a February 2024 post |
| Braze | Machine opens reported separately; they are not covered by bot click filtering | Suspected bot clicks removed from click metrics once the setting is on; is_suspected_bot_click and suspected_bot_click_reason fields in Currents and Snowflake | Remove bot clicks workspace setting, on by default for workspaces created from July 9, 2025; not retroactive |
| Bloomreach | No flag documented for MPP opens; some dashboards exclude MPP opens from open rates | bot = true property added to clicks identified as bots and excluded in reporting; the documentation says it does not suppress events and will not identify 100% of bots | Automatic bot detection is switched on or off in project settings; default not documented |
| Customer.io | Human and machine opens; every Apple Mail open counts as non-human unless a click shows a human | Human and machine clicks; machine field on click webhook events | No setting documented; split available for opens since March 20, 2025 and clicks since April 20, 2025 |
| Postmark | No flag documented; documents that Apple MPP produces false-positive opens | Not documented | Not documented |
Defaults differ. Mailchimp, HubSpot and Mailjet document filtering as on by default, and Klaviyo and Braze do so for new accounts or workspaces. Brevo documents the opposite, with bot activity and Apple MPP opens included in open metrics until you change a setting, and ActiveCampaign ships its BotSense filter set to "Not filtered". If you have not checked the setting, you may not know which numbers you are reading.
History is handled differently. Klaviyo says its reports were updated retroactively to January 1, 2022. Mailchimp lists dates from which filtered data is available for past metrics. ActiveCampaign says BotSense will not retroactively add or remove opens or clicks, and Braze says bot click filtering does not apply retroactively. Customer.io gives the dates from which its human and machine split is available. Most of the other pages say nothing, so a change of setting may or may not change last quarter's report.
Detection is described as a heuristic. Iterable calls its isBot field a heuristic, not a definitive identification. ActiveCampaign says there is no perfect measure for determining bot clicks and that human actions might occasionally be flagged. Klaviyo documents that it cannot distinguish a human open from an automated one when Apple MPP is on, and Bloomreach says its bot detection will not identify 100% of bots.
Methods are rarely named. Where a platform describes how it detects bots at all, it gives a general description such as IP filtering and behavioral analysis. None of the pages we read says which vendor or data source supplies the detection, and none says it relies on another email provider's results. If your platform sends through one of the providers above, ask it directly which flags it uses.
What to check: compare each platform's documented flag with what your reports do. A field or a filter tells you a platform looked for bots. It does not tell you how many it found.
Mailgun's documentation says automated systems can open messages and follow links, and that it "will attempt to detect" when one retrieves the tracking pixel or clicks a link. When it detects one, it indicates this in the client-info.bot field of open and click events. The documented values are apple (Apple Mail Privacy Protection), gmail, and generic, described as an unknown bot, "mostly likely a firewall or anti-virus scan". An empty value means no bot was detected.
The documentation does not say whether this is on by default, whether it can be switched off, or whether it applies to historical events. Mailgun's announcement post, dated February 23, 2023, says Bot Detection "is available in Mailgun" and describes the Apple check as based on a generic user agent. The documentation page shows only "Last updated 1 year ago".
What to check: whether your reports and automations read the client-info.bot field. Nothing in the documentation says Mailgun's own statistics exclude flagged events.
SendGrid's Event Webhook adds an sg_machine_open boolean to open events. It is set to true when SendGrid believes the open was triggered by Apple Mail Privacy Protection activity (documentation last modified July 23, 2026). Twilio notes that a person who has this feature on can have a genuine open flagged true too, because every message to that recipient is handled the same way. The documentation's advice is to rely on opens where the field is false. It describes a click as "a strong measure of engagement".
A SendGrid support article is more cautious about clicks. It says SendGrid "does not filter out clicks or opens that are produced by recipient bots or security software", so all activity is included in reporting, and that its system "does not distinguish between legitimate and illegitimate clicks". The article shows no date apart from a 2020 footer, so confirm it still holds. It suggests checking user agent strings, many clicks at the moment of delivery, and the same IP address across many click events.
No flag for bot or scanner clicks, and no sender-side setting to exclude machine opens, is documented on the pages we read.
What to check: filter Apple opens by sg_machine_open in your own reporting, and treat clicks that arrive within seconds of delivery with caution.
SparkPost is now part of Bird, and the current documentation is on bird.com. Bird's events documentation tells you to check is_prefetched before counting an open, because it is true when "an inbox privacy feature fetched the pixel automatically rather than a person opening the message". The field is on open events returned by the events API. Bird's Apple Mail Privacy page adds that "the dashboard open rate uses non-prefetched opens, while the raw counts remain available".
For clicks, the same page says automated link scanners can also generate clicks, and recommends clicks, replies and conversions over opens as stronger evidence of engagement. No bot or scanner flag is documented for click events, and the pages show no publication dates. A 2021 SparkPost post, updated November 18, 2021, says a field was added to webhooks and the events API to indicate a pre-fetched open. It does not name the field.
No setting for this, and nothing about restating historical data, is documented on the pages we read.
What to check: whether your own reporting uses is_prefetched, and whether the open rate you read matches the dashboard's non-prefetched count.
Amazon SES announced on August 7, 2026 that open and click event notifications now include an isBotEvent field, which indicates whether the event was likely triggered by an automated system or a human recipient. The documented values are Likely and Unlikely. The announcement says that if you already publish open or click events to an event destination, the field is included automatically and "no additional configuration is needed". It describes the field as "a signal" to help you understand how much engagement comes from human recipients versus automated systems.
The pages we read do not say how SES decides an event is automated, and do not say whether SES's own reports leave flagged events out. SES's metrics FAQ also warns that tracking counts can be skewed when a recipient's provider protects their privacy or caches images or links.
What to check: that your event pipeline stores isBotEvent, and that whatever builds your engagement reports uses it.
Omnivery classifies bot opens and bot clicks on the opens and clicks it tracks for you. Every Omnivery customer who uses Omnivery's open and click tracking gets bot detection automatically, at no additional charge. It is not a setting you switch on and not a separate plan. The verdicts come from the Omnivery Bot Detection API, which classifies Non-Human Interactions with unparalleled accuracy, using 20+ proprietary datasets developed over 8+ years.
The same detection is available on its own as the Omnivery Bot Detection API for tracking data collected somewhere else, whether that is another email platform, an ad system or your own tracking. The requirement is that you can supply the source IP and the user agent string for each interaction. Access is enabled per domain after a short technical review.
What to check: if your current platform only flags part of the picture, such as Apple opens, or flags without leaving flagged events out of your reports, a per-event verdict on the data you already collect closes the gap. Our product page explains how it works.
What to do
The same approach works on any of the four platforms.
Check whether the platform marks opens, clicks or both, and whether the field appears in the events you receive or only in the dashboard.
A flag you do not store cannot be used later. Keep it alongside the event so reports and automations can read it.
A flag is not proof either way. Likely and unlikely are likelihoods, and a recipient who really did open a message can be flagged as well.
A single flagged or unflagged click is weak evidence. Require more than one signal before an event changes a score, starts an automation or suppresses an address.
Match click reports against onsite sessions and revenue. If clicks are high and sessions are not, suspect non-human activity regardless of what the flag says.
Platforms add and change these fields. Amazon SES announced its field in August 2026, so any older comparison is out of date.
At a glance
Questions
Mailgun documents that it attempts to detect bots and marks open and click events through the client-info.bot field. The documentation does not say whether flagged events are left out of its statistics.
A boolean on open events in the Event Webhook, set to true when SendGrid believes Apple Mail Privacy Protection triggered the open. It covers Apple opens only, and a real open by someone with the feature on can also be true.
A SendGrid support article says it does not filter clicks or opens produced by recipient bots or security software, so all activity is included in reporting. The article is undated apart from a 2020 footer, so check its current status.
A field on open events that is true when an inbox privacy feature fetched the tracking pixel automatically. Bird documents that its dashboard open rate uses non-prefetched opens while raw counts remain available.
Yes. Since August 7, 2026 Amazon SES open and click event notifications carry an isBotEvent field with the value Likely or Unlikely. SES documents no setting for it and does not describe how events are classified.
Not by themselves. A flag marks an event. Whether a report excludes flagged events depends on the platform and the report, and the documentation we read says so only for Bird's dashboard open rate.
Omnivery classifies them. Bot detection is applied to the opens and clicks Omnivery tracks, included automatically at no additional charge. For tracking data from another platform, the Omnivery Bot Detection API returns a per-event verdict, subject to a short technical review.
Mailchimp and HubSpot document bot filtering as on by default, Klaviyo documents bot clicks as excluded by default for new accounts, and Braze documents bot click filtering as on for workspaces created from July 9, 2025. ActiveCampaign documents its BotSense filter as set to Not filtered by default. Check the setting in your own account.
None of the documentation we read says so. Where a platform describes its detection, it gives a general method such as IP filtering and behavioral analysis, and names no vendor. If you send through one of those providers, ask your platform which flags it uses.
Flags cover what the platform detects. Documentation for these platforms does not claim to flag every non-human click, so compare click reports with onsite sessions and revenue.
All pages were read on October 19, 2026. Where a page shows no date, we say so above.
Bot detection is included for opens and clicks tracked by Omnivery, and the Omnivery Bot Detection API applies it to tracking data from elsewhere.