Is Bananatag Email Tracking You? Block s.bl-1.com

Bananatag email tracking is the machinery behind that image. Bananatag began life as an email read receipt tool, merged into the internal communications company Staffbase in 2021, and is sold today as Staffbase Email. The product has not changed shape: it embeds a pixel unique to you in every internal message, rewrites every link so a click passes through a server first, and reports the result to whoever sent the newsletter. What follows is drawn from Staffbase's published support articles and from checks we ran against the tracking hosts on 27 August 2026.

Key Takeaways

• Bananatag and Staffbase announced their merger on 4 March 2021, and the product is now branded Staffbase Email, though app.bananatag.com still answers.
• Staffbase documentation states that "each Employee email is embedded with a unique tracking pixel and personalized links, tailored specifically to each recipient."
• The default tracking hosts are s.bl-1.com and s2.bl-1.com for accounts hosted in the United States, and es.de.bl-1.com for accounts hosted in the EU.
• Requesting https://s.bl-1.com/ returns an HTTP 301 to s2.bl-1.com, and both names resolve to a single Amazon load balancer in the us-west-2 region, checked 27 August 2026.
• Employers can move tracking onto their own subdomain with one CNAME record, and the documented target, custom-domain-2.bananatag.com, resolves to that same load balancer.

What Is Bananatag?

Bananatag is an email tracking product from Kelowna, British Columbia, now shipping as the email module of the Staffbase internal communications platform. Staffbase's press release, Staffbase and Bananatag Merge, dates the announcement to 4 March 2021 and describes a company that "began as email tracking software" before growing into a platform used by 600 organisations. Staffbase's landing page is titled Bananatag is now Staffbase Email.

The rename matters less than it sounds. The brand was pulled from the interface; the infrastructure was not, and Staffbase's setup instructions still point at hostnames under bananatag.com. One thing separates this from a marketing tracker. The sender signs your paycheque, the recipient list is the staff directory, and there is no unsubscribe link.

What Does Bananatag Email Tracking Actually See?

It sees that you specifically opened the message, roughly when, and every link you clicked, because the pixel and the links are unique to you rather than to the campaign. Staffbase's article on how employee email tracking works states that "each Employee email is embedded with a unique tracking pixel and personalized links, tailored specifically to each recipient," and that "an extra wrapper URL will be added to the beginning of each link," though "this is not obvious to the recipient." The report can show:

• That you opened it, and when. Staffbase's page on counting opens and clicks says an open "is triggered when a recipient loads your email and views the body of the message."
• You as a person, not a number. "Your recipients' Unique Contact IDs are stored in your distribution lists," which is how one person reading on three devices counts once.
• Repeat opens, clicks, file opens and survey answers, plus the IP address and user agent every image request carries, which turn a timestamp into a location and a device.

The honest other half: the pixel does not read the message body, touch your other mail or record your screen. Everything is inferred from the fact that a request happened, from where, and when. And the employer already wrote the newsletter. What tracking adds is not content. It is attendance.

The numbers are also softer than the dashboard suggests. Apple's Mail Privacy Protection fetches remote content on arrival rather than when you read, so Apple Mail users register as opens they never made. Staffbase concedes drift the other way, warning that scanning by "security systems in a customer's environment" can "record abnormally high opens and/or clicks." When leadership hears that 94 percent of staff read the memo, some of that is a mail server doing housekeeping.

What Is s.bl-1.com?

s.bl-1.com is the default host serving Bananatag tracking pixels and click redirects for US hosted accounts. Staffbase's guide to enabling a custom domain for employee email tracking names them outright: "https://s.bl-1.com or https://s2.bl-1.com" for US hosting, and "https://es.de.bl-1.com" for EU hosting. The name gives nothing away: two letters, a digit and a dash, appearing nowhere in the branding of the mail it arrives in.

We checked the hosts on 27 August 2026. https://s.bl-1.com/ answers with an HTTP 301 from a server identifying itself as awselb/2.0, redirecting to s2.bl-1.com, so the two names are one service. Both resolve through a single Amazon load balancer, alb00-production-1838928655.us-west-2.elb.amazonaws.com, in Oregon. The certificate is a wildcard for *.bl-1.com, so any subdomain can be raised without surfacing in certificate transparency logs.

The EU host is a separate deployment: es.de.bl-1.com resolves to bt-prod-eu-c1-alb-6485768.eu-central-1.elb.amazonaws.com in Frankfurt, where that bt prefix is the last visible trace of Bananatag in the delivery path. If your employer runs the EU tenancy, blocking the .com hosts protects you from nothing, a first hint that hostname lists are fragile here. Our guide to blocking email tracking in Gmail covers the general case.

Why Does the Custom Domain Make It Harder to Block?

Because your employer can move the pixel onto a subdomain of its own website with one DNS record, after which nothing in the message points at Staffbase. The custom domain article walks an administrator through a CNAME record aimed at custom-domain-2.bananatag.com for US accounts or custom-domain.de.bananatag.com for EU accounts.

Here is the part worth sitting with. We resolved that target, and custom-domain-2.bananatag.com returns the same Amazon load balancer in us-west-2 as s.bl-1.com. The custom domain is not a separate system, tenant or data path. It is the identical service under a friendlier name. Block s.bl-1.com and call it done, and you are still loading pixels from that same machine, now labelled news.yourcompany.com.

Staffbase gives two reasons: brand consistency, and avoiding "potential issues related to internal phishing training programs." Read the second slowly. The tracking domain resembles attacker infrastructure closely enough to trip the company's own security awareness training, and the documented remedy is to make the tracker look more trustworthy rather than to stop wrapping links.

So a static blocklist is the wrong primitive. There is no fixed set of hostnames when every customer mints its own. What survives a rename is the shape: a one pixel image with a long opaque identifier in its path, and links resolving somewhere other than their text claims. Blocking has to work per message, on those signatures, as it does for Firstup and its clicks.onfirstup.com redirects.

Is Employee Email Tracking Legal?

In the EU it can be lawful, but it is employee monitoring rather than marketing, and it does not run on consent. GDPR Article 88 lets member states write their own rules for staff data, and requires safeguards covering "the transparency of processing" and "monitoring systems at the work place." Consent is weak in employment, because a regulator will ask whether a person can refuse their employer. In Germany and much of the EU this is a works council matter, not a checkbox a communications manager ticks.

A works agreement is no blank cheque. In MK v K GmbH (Case C-65/23), decided 19 December 2024, the Court of Justice of the EU held that processing the GDPR does not permit cannot be legitimised by an agreement between employer and works council, and that national courts keep full power to review whether it is necessary.

One gap, stated plainly: we found no published decision from any European data protection authority ruling specifically on open tracking in internal staff newsletters. That is not evidence the practice has been blessed, nor condemned. It has not been tested head on. The safer reading for a privacy officer is that this sits on legitimate interests, needs a balancing test that survives a regulator, and needs a notice saying per employee reporting exists rather than gesturing at "engagement analytics," per the Irish DPC's employer guidance. If your notice says aggregated and your dashboard shows names, that gap is what an auditor writes up.

How Do You Actually Block Bananatag Tracking?

Stop remote images loading, which kills the open record, then deal separately with the rewritten links, which image settings never touch. Start with what you have:

• Gmail on desktop. Settings, See all settings, Images, choose Ask before displaying external images, save, per Google on turning images on or off in Gmail. The default proxy is not this setting: it hides your address but still fetches the image, so the open lands.
• Outlook. Trust Center, Automatic Download, block pictures in HTML email. On a managed machine Group Policy may set this the other way, and your change will not survive.
• Apple Mail. Protect Mail Activity hides your address, but fetches remote content ahead of time, feeding the sender a false open rather than no open.

All three share one hole. They are about images, and much of what Bananatag reports comes from links. Every URL is wrapped, so clicking through to the benefits portal registers the click, the time and your identity whatever your image setting says.

What About Ugly Email, PixelBlock, Trocker, Proton Mail and HEY?

Each does something real. Where they stand:

• Ugly Email flags tracked messages with an eye icon in Gmail, but it is a detector first, working from a list of known domains, which a customer specific CNAME defeats.
• PixelBlock blocks pixel loads inside Gmail and tells you who tried. It targets images, not wrapped links.
• Trocker is open source and marks tracked mail across browsers. Community maintained lists update on volunteer time, slow next to how fast a company adds a subdomain.
• Proton Mail and HEY block remote content by default and name the senders they caught. Strong, but each means moving your mail, and neither is where the work newsletter arrives.

Our comparison of Ugly Email, PixelBlock and Trocker goes deeper, and our roundup of email tracker Chrome extensions covers the trackers themselves. Gblock is built for the two gaps above: it blocks tracking pixels from loading, and strips tracking redirects out of links before you click. Its blocklist updates on its own rather than waiting on a release, which matters when a tracking host moves with one DNS record, and it runs inside Gmail so your address and provider stay put. Stated straight: we have not tested a live Staffbase Email send, and no extension undoes a policy pushed to a locked down work laptop.

What This Means for Your Inbox

The internal newsletter is the most heavily tracked message nobody questions. You never subscribed, you cannot unsubscribe, and it lands in the same inbox as everything else. Bananatag is the fourth vendor we have taken apart after Poppulo and its newsweaver.co.uk hosts, Firstup and Workshop, and the architecture repeats: a pixel unique to the recipient, wrapped links, an obscure hostname, and an option to hide it behind the employer's brand. Four products, one design.

A single open record is unremarkable: a timestamp, a rough location, a device, your name from the identifier in the URL. Multiply it by a weekly send and it becomes a log, running the length of your employment, of when you read company mail and from which network. Nobody set out to build an attendance system. It is what you get when a metric meant to tell a communications team whether the memo landed is kept per person, indefinitely. You will probably not win the argument about whether your employer measures engagement. The narrower question you can still answer is whether the request leaves your machine.

Sources: Staffbase: How Does Employee Email Tracking Work; Staffbase: Enabling a Custom Domain for Employee Email Tracking; Staffbase: Counting Opens and Clicks With Employee Email; Staffbase: Staffbase and Bananatag Merge; Staffbase: Bananatag is now Staffbase Email; GDPR Article 88; CJEU, MK v K GmbH, Case C-65/23, 19 December 2024; Irish Data Protection Commission: Data Protection in the Workplace; Apple: Use Mail Privacy Protection on iPhone; Google: Turn images on or off in Gmail. DNS, HTTP header, TLS certificate and whois observations were made on 27 August 2026 and may change.