Is Amazon SES Tracking Your Email? How to Block It

Amazon SES tracking works differently than most people assume, and the difference matters if you are trying to stop it. Amazon Simple Email Service is the plumbing behind an enormous share of the order confirmations, password resets, shipping alerts and newsletters landing in your inbox. When a sender turns on open tracking, SES drops an invisible 1x1 GIF into the message. Here is the part almost nobody gets right: that pixel is not hosted on amazonses.com. Blocking that domain accomplishes nothing.

Key Takeaways

• Amazon SES processes over a trillion emails per year, roughly 2.7 billion per day, according to AWS.
• SES open tracking is not automatic on every send: a sender must create a configuration set, attach an event destination and enable the Opens event type.
• The SES open tracking pixel and rewritten click links are hosted on regional r.<region>.awstrack.me domains, not on amazonses.com.
• SES click tracking rewrites up to 250 links per message so every click passes through an Amazon server before redirecting.
• Senders can point tracking at a verified subdomain they own through CreateConfigurationSetTrackingOptions, which removes every visible Amazon identifier from the URL.

What Is Amazon SES and How Much of Your Inbox Runs on It?

Amazon SES is a bulk email sending service that companies plug into instead of running their own mail servers. AWS reported in January 2025 that the service processes over a trillion emails each year. Divide that out and it is about 2.7 billion messages a day, or roughly 32,000 every second.

SES is cheap and unglamorous, which is exactly why it is everywhere. It handles the boring mail: two factor codes, receipts, "your package shipped" notices, SaaS digests. You almost certainly received several SES delivered emails today without noticing.

Assuming SES is doing the tracking can also send you after the wrong domain. EmailOctopus is widely described as an SES reseller, but only its legacy Connect product uses AWS tracking domains, while its main platform routes clicks through a SparkPost backed host instead.

Does Amazon SES Track Email Opens by Default?

No. Amazon SES does not track opens on every message automatically, and any article that tells you otherwise has not read the documentation. Open tracking is scoped to a configuration set, and a sender has to deliberately wire it up.

Per the AWS SES sending metrics FAQ, the sender must complete four steps: create a configuration set, create an event destination inside it, configure that destination to publish open event notifications, and then specify that configuration set on every email they want tracked. Skip any step and no pixel is inserted.

That answer cuts both ways. Setting it up takes minutes in the AWS console, and marketing teams who care about open rates do it as a matter of course. Plenty of purely transactional senders never bother. So it depends on the sender — and you can check per message. The rest of this guide shows you how.

How Does the Amazon SES Tracking Pixel Work?

SES inserts a 1 pixel by 1 pixel transparent GIF with a filename unique to that specific message, hosted on a server Amazon operates. AWS describes the mechanism plainly in its custom open and click domain documentation: "when the image is downloaded, SES can tell exactly which message was opened and by whom."

The moment your mail client loads that image, the sender learns:

• That you opened it, and when — down to the second
• How many times you reopened it — AWS counts each open as a separate event
• Your approximate location — derived from the IP address that requested the image
• Your device and client — inferred from the request's user agent

Three details are worth knowing. SES keeps collecting open and click metrics for 60 days after a message is sent. Open tracking only works on HTML mail, so a plain text send produces no open data at all. And while the pixel defaults to the bottom of the email, senders can relocate it anywhere using the {{ses:openTracker}} placeholder. AWS explicitly recommends moving it to the top to beat preview truncation, since a clipped message means the pixel never loads.

If this pattern sounds familiar, it should: SendGrid uses the same open tracking model, down to the transparent GIF and the per recipient identifier, and Postmark routes tracked links through click.pstmrk.it with the same rewrite mechanic.

How Does SES Click Tracking Rewrite Your Links?

When click tracking is on, SES replaces every hyperlink in the HTML body with a unique redirect URL pointing at an Amazon server. You click, Amazon logs the event, and you get forwarded to the real destination fast enough that you rarely notice the hop.

AWS caps this at 250 links per message. That is a quarter of SendGrid's 1,000 link ceiling, but it is far more than any real email contains, so treat it as "every link." Because each redirect URL is unique, SES can tell which recipient clicked which link, at what time, and which message they came from. Senders can also attach arbitrary key value metadata to individual links with the ses:tags attribute, which flows straight into their analytics.

There is an escape hatch, but it belongs to the sender, not you. Adding ses:no-track to an anchor tag exempts that one link from rewriting, and SES strips the attribute before delivery so you never see evidence it was considered. This is the same mechanic covered in our breakdown of how link wrapping rewrites every URL you click.

Click tracking matters more than open tracking for one reason: Gmail's image proxy does nothing for it. Your real IP address hits Amazon's server directly, every single click.

Why Blocking amazonses.com Does Not Stop SES Tracking

This is the part most coverage gets wrong. The domain amazonses.com shows up in SES email headers — in the Return-Path, in Message-IDs, in the DKIM signing domain dkim.amazonses.com. It is a delivery identifier. The tracking pixel is not there.

Per the AWS General Reference endpoints table, SES serves open and click tracking from a completely separate set of regional domains shaped like r.us-east-1.awstrack.me or r.eu-west-1.awstrack.me. There are 29 of them, one per region. Nothing in that hostname says Amazon, AWS or SES. If your blocklist filters on amazonses.com, every pixel still fires.

It gets worse for domain based blocking. The CreateConfigurationSetTrackingOptions API lets a sender substitute a verified subdomain of their own for the awstrack.me host. AWS states the goal directly in the developer guide: using your own domain means "all SES indicators are removed." So a tracking pixel that should read r.us-east-1.awstrack.me instead reads email.yourbank.com, a first party looking subdomain that no generic blocklist will ever touch.

The implication is uncomfortable. Any blocking approach built on "does this URL contain a known tracker domain" is structurally defeated by a feature AWS ships in the console and documents as a customer experience improvement.

How Can You Tell If an Email You Got Came Through SES?

You can check any message in about thirty seconds. In Gmail, open the email, click the three dot menu at the top right, and choose Show original. Then look for these markers, and see our full walkthrough on how to detect email tracking pixels in Gmail.

• Was it sent through SES? Search the raw source for amazonses.com. Check the Return-Path, the Message-ID (SES generated IDs usually end in @email.amazonses.com), and the DKIM-Signature d= value.
• Is open tracking on? Search the HTML body for awstrack.me. Any <img> tag pointing there, usually right before the closing body tag, is the open pixel.
• Is click tracking on? Look at the href values. Rewritten SES links start with the tracking host and encode the real destination inside the path, so the visible link text and the actual target will not match.
• Custom tracking domain? If the message is clearly from SES but contains no awstrack.me anywhere, look for links pointing at an unfamiliar subdomain of the sender's own domain. That is CustomRedirectDomain at work.
• Skip the source view: hover any link and read the status bar. If the host is not where the link claims to go, it is wrapped.

What This Means for Your Inbox

The events SES captures do not sit in a vacuum. Every open and click is published to an event destination the sender chooses: CloudWatch, Amazon SNS, Amazon Data Firehose, EventBridge or Pinpoint. From Firehose it lands in a data lake. Your open timestamps become rows in a table the sender can query, join against your account record, and keep indefinitely.

Because SES handles transactional mail rather than just marketing blasts, the tracked messages are the ones you cannot unsubscribe from. You need the password reset. You need the delivery notification. There is no preference toggle that says "send me my receipt without the pixel," and no sender is going to add one. Opening a bank alert at 2:14 a.m. from a hotel IP in another country is information you handed over without ever agreeing to.

Gmail's image proxy is widely misunderstood here. Google fetches and caches the image on its own servers, hiding your IP from the open event — but it does not prevent the fetch. The open still registers, sometimes at delivery time before you have looked at the message.

How to Block Amazon SES Tracking

1. Turn off automatic image loading in Gmail. Go to Settings → General → Images and select "Ask before displaying external images." Nothing loads until you approve it, which stops the open pixel cold. The cost is real: legitimate images in every email break too, and you will click "display images" often enough to start doing it reflexively. It also does nothing about click tracking.

2. Stop clicking wrapped links. When you spot a rewritten URL, navigate to the site directly instead of through the email. Tedious, but it is the only manual defense against click tracking that works.

3. Use a dedicated blocker extension. Gblock intercepts tracking pixels inside Gmail before the request leaves your browser, and strips tracking parameters from links so you land on the real destination without the redirect hop. Its blocklist updates automatically, which matters specifically because of the custom subdomain problem described above. Free alternatives worth knowing: Ugly Email flags tracked messages with an eye icon in your inbox list, PixelBlock blocks pixels and reports who tried to track you, and Trocker handles both pixels and link unwrapping. None of these, Gblock included, can catch a tracker it has never seen on a domain that looks like the sender's own.

4. Change mail providers, if you are willing. Proton Mail blocks remote content by default and proxies images through its own servers. HEY strips tracking pixels automatically and names the sender who tried. Both are real upgrades over stock Gmail, and both mean leaving your current address behind — a much bigger decision than an extension install.

Whichever route you pick, the useful shift is this: SES tracking is not one thing to block. It is an image request and a link redirect, on domains that may not name Amazon at all. Handle both, or you have only handled half.