Is Canva Tracking Your Email? How to Block It

Canva email tracking is not something you have to infer from server logs. Canva writes it down. Its privacy policy says that alongside web beacons on the site, "we may also use clear GIFs in HTML-based emails sent to our users to track which emails are opened and which links are clicked by recipients." The plain language summary underneath is blunter still: "We might use small images in order to check how many people open our emails and visit our site." So the question is not whether, but where. We read Canva's policy and help centre, then probed its DNS, certificate transparency records and live servers on 21 September 2026.

Key Takeaways

• Canva's privacy policy states it uses clear GIFs in HTML emails "to track which emails are opened and which links are clicked by recipients."
• On 21 September 2026, the host l.engage.canva.com answered SendGrid's open tracking path with HTTP 200 and a 43 byte GIF89a image measuring one pixel by one pixel, while a nonsense path on the same host returned a 404 HTML page.
• Canva's apex SPF record chains nine separate include lookups covering six vendors: SendGrid, Mailchimp, Amazon, HubSpot, Zendesk and Google.
• Canva's help centre says you cannot unsubscribe from account and security related communications, and it documents no control over the open tracking pixel itself.
• Emails you design inside Canva are sent and measured by Mailchimp, Klaviyo or Constant Contact, not by Canva, so the tracking on those belongs to the ESP.

Does Canva Track Whether You Open Its Emails?

Yes, by its own account. The clause headed "Clear gifs/web beacons information" in the Canva privacy policy covers two things at once: beacons on the website, and beacons in email. The email sentence is unambiguous about both halves of the measurement, opens and clicks.

That second half matters more than people expect. An open needs one invisible image. A click rate needs every link in the message rewritten so it travels through a logging server first and then forwards you to where you meant to go. Canva states it collects both.

Disclosure is not consent, and a policy paragraph is not a control. Nowhere in the policy or the help centre did we find a setting that turns the pixel off while leaving the emails on. The pattern matches SendGrid's own tracking behaviour, which is unsurprising once you see which servers Canva uses.

Which Canva Server Serves the Pixel?

One host answered, and it is not the one with the obvious name. l.engage.canva.com returned HTTP 200 on SendGrid's open tracking path /wf/open?upn=abc, with content-type: image/gif and a body of exactly 43 bytes. The magic bytes read GIF89a, and the two little endian shorts that follow decode to a width of 1 and a height of 1. A single transparent pixel, served live.

Three controls hold that reading up:

• A nonsense path on the same host, /zzznonsense9182, returned 404 with a 1,084 byte HTML error page. So does /wf/nonsense9182. The pixel path is a purpose built endpoint, not a catch all.
• The click path /ls/click?upn=abc returned 400, not 404. That is a live click handler rejecting an unsigned token rather than a server with nothing at that address.
• A nonsense subdomain, zzq7canvanope99.canva.com, resolved to nothing at all: NOERROR with zero answers, no A record and no CNAME. The Canva hostnames in this article are real, not wildcard artefacts.

As a reference control, sendgrid.net itself returned the identical 200 and 43 byte GIF on that path, and 404 on nonsense. Canva's branded host behaves exactly like the vendor's. That is what SendGrid's link branding is designed to do: put the sender's domain on the tracking request so the recipient sees canva.com rather than a vendor name.

The DNS behind it lines up. engage.canva.com publishes v=spf1 include:sendgrid.net include:amazonses.com ~all, its only MX record is mx.sendgrid.net, and its DKIM selectors point at SendGrid subuser u6055632. That is a fully authenticated SendGrid sending domain with its own branded link host sitting one label to the left.

How Many Vendors Touch Canva's Mail?

Six, at least, and the SPF record is the receipt. Canva's apex domain lists no senders inline. It chains nine include lookups, _spf1.canva.com through _spf9.canva.com, because one record cannot hold the address list. We ran every netblock through ARIN, APNIC and RIPE rather than guessing, and the owners came back as:

• SendGrid — the 167.89.x addresses sit in SENDGRID-167-89-0-0-17.
• Mailchimp — 198.2.128.0/18, 205.201.128.0/20 and 148.105.0.0/16 all return org MailChimp. Canva's apex also carries k1 and k2 DKIM selectors pointing at dkim.mcsv.net.
• Amazon — several AWSEMAIL and SES2025 ranges. Separately, mail.canva.com authorises exactly twenty addresses, 54.240.76.81 to 54.240.76.100, and bounces to feedback-smtp.us-east-1.amazonses.com.
• HubSpot — 143.244.80.0/20, 141.193.184.x and others register to HUBSP-8.
• Zendesk — ARIN's 216.198.0.0/18, plus ZENDESK-AU in APNIC and EU-ZENDESK in RIPE.
• Google — 209.85.128.0/17 and 74.125.0.0/16, which is Workspace.

Certificate transparency adds two more names worth knowing. link.recruitment.canva.com points at eu.mailgun.org, so job applicants get a seventh vendor. And movable-ink.canva.com resolves to a CloudFront distribution. Movable Ink renders email images on request rather than in advance, which makes every image a live callback; we cover the mechanism in our write up of Movable Ink. Our probe of that host did not discriminate, though, so we are naming it as DNS, not as a proven pixel. For what SES contributes on its side, see Amazon SES open tracking.

The Host Named Tracking Is Not the Tracker

Here is the part that would fool a keyword search. tracking.canva.com is a real host, and it has nothing to do with email. It is a CNAME to canva.aftership.com: parcel tracking for Canva Print orders. The genuine pixel lives on a host whose name, l.engage.canva.com, gives away nothing at all.

Two hostnames stayed opaque. track.canva.com is real, resolving through Cloudflare while our nonsense subdomain resolved to nothing, but every path we tried returned an empty HTTP 400 with no body, the nonsense path included. A probe whose control and treatment answer identically proves nothing, so we are not calling it a tracker. And l.create.canva.com and l.support.canva.com are CNAMEs to Branch deep links at thirdparty.bnc.lt that refused our TLS handshake. That is the honest shape of certificate transparency work: it hands you the map, not the territory.

What About Emails You Design in Canva?

If you build an email in Canva and send it to a list, Canva is not the one measuring the opens. Canva's help centre article on unsubscribe and preference links says that Canva email templates carry those links by default and that "When you publish with an ESP integrated with Canva, such as Mailchimp, Klaviyo, or Constant Contact, Canva automatically formats the links for that platform."

The same page defines the term for its users, and the definition is telling: "An Email Service Provider (ESP) is a tool you use to send and track bulk emails, like Mailchimp, Klaviyo, or Constant Contact." Canva adds that "The email service provider (ESP), not Canva, stores and manages the unsubscribe list and opt-out preferences."

So the answer for this surface is no. Canva is the design tool; the tracking on a campaign you built there is your ESP's, on your ESP's hosts, under your ESP's settings, and the consent obligation is yours as the sender.

Can You Turn Canva Email Tracking Off?

Not directly, and this is where the controls Canva does offer stop short. The help centre page on email subscriptions and notifications describes a Message preferences screen with a Tips and News tab for marketing and an Account tab for team activity. You can switch marketing off, pick a frequency of Anytime, Weekly, Monthly or Snooze for 3 months, and choose a channel. Changes take "up to 3 business days."

Every one of those toggles governs whether a message is sent. None governs whether a sent message is measured. And the page states the boundary directly: "You can't unsubscribe from account and security-related communications." The privacy policy draws the same line, listing "account verification, purchase and billing confirmations and reminders, changes/updates to features of the Service, technical and security notices" as mail you may not opt out of.

Stack those facts and the gap shows: mail you cannot refuse, and a tracking mechanism you cannot switch off. Whether the pixel rides on that unrefusable mail is the one thing we could not confirm, and we say so below rather than guess.

Does Australian Privacy Law Cover This?

Canva is an Australian company, and Australia spent 2026 deciding what a pixel is worth. On 24 June 2026 the Privacy Commissioner found two organisations in breach of Australian Privacy Principles 3.3, 5.1 and 7.1 over third party tracking pixels used for targeted advertising without the knowledge of the people affected, according to the OAIC.

Read the regulator's own guidance, though, and the limit shows. The OAIC's tracking pixels and privacy obligations note defines a pixel as "a piece of code generated by the third-party provider that can be placed on an organisation's website to collect information about a user's activity," and confines itself to a footnote on the rest: "Tracking pixels may also be used in apps, emails and other digital channels. This guidance note primarily refers to the use of tracking pixels on websites."

That footnote is the whole compliance story for inboxes in Australia. No ePrivacy equivalent forces prior consent for an email beacon, which is why Canva can disclose the practice and stop there. Europe went the other way, with France's CNIL and Italy's Garante both landing on prior consent for open rate pixels; we tracked the divergence in Australia's second wave privacy reforms. Use Canva to reach European recipients and the gap between the two regimes is yours to close.

How to Block Canva Email Tracking in Gmail

First, verify it for yourself. Open a Canva email in Gmail, use the three dot menu and choose Show original, then search the raw source for l.engage.canva.com. Do not search for width=1, the advice you will find everywhere else. Pixels are declared in many ways, and we have caught trackers shipping a 2x2 image precisely so that search fails. Search the hostname instead.

Then pick a defence. Honestly compared:

• Gmail's own image setting. Settings, General, then Ask before displaying external images. Free and complete, and it breaks every legitimate image too. Note that Gmail's image proxy is not a defence: it hides your IP address behind Google's, but it still fetches the pixel, so the open is still logged.
• Ugly Email. Open source, flags detected trackers with an eye icon in the message list and blocks the load. The visible warning is the point. The blocklist is curated by hand, so new hosts take time to arrive.
• PixelBlock. Blocks pixel requests in Gmail and marks caught messages with a red eye. It stops the open. It does not touch rewritten links.
• Trocker. Marks pixels, warns before a tracked link resolves, and works across several webmail clients rather than Gmail alone.
• Proton Mail or HEY. Both block remote images and strip spy pixels by default, and both do it well. Same cost either way: you move your mail somewhere else.
• Gblock. Stays inside Gmail, blocks the pixel, and strips tracking redirects out of links so pressing a button in a Canva email is not reported on the way through. The blocklist updates automatically, which is what matters for branded hosts like l.engage.canva.com that a hand maintained list can miss.

One honest limit: none of these stop Canva knowing you logged in, opened a design or placed a print order. Blocking open tracking removes the inbox measurement, not the product telemetry. We scored the options side by side in how to block email tracking in Gmail, and catalogued the tools pointed the other way in email tracker Chrome extensions.

What This Means for Your Inbox

The lesson from Canva is about naming. Audit your own mail, reach for the host called tracking, find a parcel service, and you would conclude there was nothing there. The pixel sat on l.engage, indistinguishable from a link shortener. Blocklists that chase brand names lose this game; the ones matching vendor path shapes such as SendGrid's /wf/open?upn= catch it whatever the hostname says.

That generalises. Any company routing lifecycle mail through SendGrid link branding gets the same endpoint on its own domain, so a pattern that catches Canva catches hundreds of senders you have never audited. The vendor stays constant; only the label in front of it changes.

Blocking it costs you nothing you want. The email still arrives, the design link still opens, the print order still ships. What disappears is the request telling a dashboard you looked, and at what hour, on which device. Because that pixel loads with the ordinary remote images in HTML mail, blocking it at the Gmail layer covers every sender at once rather than one brand at a time.

What We Could Not Verify

Three gaps, stated plainly rather than papered over. We did not capture a live Canva message and dissect its source, so we cannot show from a real email which From address carries the pixel. What we have is Canva's written statement that it puts clear GIFs in its HTML email, plus a live SendGrid open tracking host on a Canva sending domain.

Second, we could not tell whether transactional notifications, the design shared with you, the comment mention, the team invite, carry the pixel, or only lifecycle mail does. The name engage points at marketing; mail.canva.com runs on twenty dedicated Amazon SES addresses and publishes no branded SES tracking domain, which fits open tracking being off there, or on and running through the shared vendor host.

Third, Canva's help centre sits behind a Cloudflare challenge that refuses automated clients, so we read those pages through a text extraction proxy; we have linked each one so you can check the wording in a browser.