Is Cirrus Insight Tracking Your Email? How to Block It

A sales rep at a company you have never bought from can learn that you read their message at 8:14pm, that you were on a phone, roughly which city you were in, and which of the three links you clicked. If that email arrived through Cirrus Insight, the Salesforce sidebar that lives inside Gmail and Outlook, the mechanism is a transparent image and a rewritten URL. Cirrus Insight email tracking is genuinely off by default, which sounds reassuring until you notice that both the rep and their Salesforce admin can flip it permanently on with a single setting.

Key Takeaways

• Cirrus Insight embeds "a small, transparent image in the email" when a sender enables Email Tracking on a message, per its own Email Tracking FAQ.
• Cirrus Insight's IT allowlist documentation names cirrustracking.com as the domain "Used for Buyer Signals (Email/Link/Reply Tracking)" — a completely separate registrable domain from cirrusinsight.com.
• Tracking links and email opens are "off by default in Gmail and OWA, and must be selected on send in order to be used," but a "Track Emails by Default" user setting and an admin controlled default both exist.
• An open notification carries the recipient's approximate location based on IP address, the device type, a timestamp, and a running count of how many times the message was opened.
• Link tracking wraps the destination URL so a click reaches Cirrus Insight's tracking server first and is then redirected, which Gmail's image blocking setting does not stop.

Does Cirrus Insight Track When You Open an Email?

Yes, whenever the sender switched Email Tracking on for that message. The company describes the mechanism without euphemism in its Email Tracking FAQ: "Cirrus Insight will embed a small, transparent image in the email." Your email client fetches that image the moment the message renders. The fetch is the open.

Two details in that documentation are worth holding onto. The pixel is tagged uniquely per recipient, so the fetch is not an anonymous hit on a counter — it ties a specific address to a specific moment. And the whole thing collapses without images. Cirrus Insight concedes that tracking cannot work in plain text mode because "plain text mode strips all formatting and images, preventing us from embedding the tracking image." That single sentence is the entire blocking strategy in miniature: no remote image fetch, no open event.

One detail gives the game away. Cirrus Insight requests inbox permissions so it can "prevent 'opens' when you open an email you've sent" — the company plainly understands that a pixel fires for reasons unrelated to anyone reading anything. It just draws that boundary around the sender's data quality rather than the recipient's privacy.

Is Cirrus Insight Email Tracking On by Default?

No, not out of the box, and that is a smaller comfort than it sounds. Cirrus Insight's performance troubleshooting guide states that tracking links and email opens "are off by default in Gmail and OWA, and must be selected on send in order to be used." A rep clicks the tracking icon, it turns blue, and that message is tracked.

But the default is a preference, not a policy. Cirrus Insight's Gmail user manual documents a "Track Emails by Default" setting that removes the per message decision entirely. And its Admin Overview Guide confirms administrators can enable or disable Email Tracking in Sidebar General settings "plus if it's enabled by default or not." One Salesforce admin can turn tracking on for every rep in the org and none of them ever has to think about it again.

Cirrus Insight is genuinely more restrained at install time than tools built purely around tracking — when we looked at whether Yesware is tracking your email, tracking was the product's reason for existing rather than a checkbox. None of that helps you as a recipient. The shipped default tells you nothing about the message currently open in your inbox. Only the message source does.

What Can a Cirrus Insight User Actually See?

More than a read receipt, and considerably more than most people assume. When a tracked email is opened, per the Email Tracking FAQ, Cirrus Insight's servers receive a notification that "includes the recipient's approximate location (based on their IP address) and the type of device (web browser, mobile phone, tablet, etc)."

Stack that with what the sidebar aggregates and the picture gets specific:

• Open count. Not a yes or no. The FAQ lists "how many times the email was opened." Reread a proposal four times over a weekend and the rep sees a four.
• Timing. Buyer Signals presents a timeline of activity with timestamps, plus bar charts of opens, clicks, and replies.
• Which link. The sidebar shows the specific links clicked, not merely that a click happened. Pricing page versus careers page is a different conversation.
• Real time alerts. Cirrus Insight can push a notification the instant a pixel fires. The rep's screen can light up while your reading pane is still open.
• Attachment behavior. A separate attachment tracking feature goes further, recording who opened a document, which pages they read, how long they spent, and whether they forwarded it to someone else.

One limit worth naming, because it is real: on an email sent to several people, the FAQ says the sender sees only that "someone" opened it rather than which recipient. Being on a distribution list is meaningfully more private than being the sole addressee. That is the closest thing to good news in this section.

Does Cirrus Insight Rewrite Your Links?

Yes. Cirrus Insight wraps destination URLs inside its own tracking URLs, so the click lands on its server first, gets logged, and is then redirected onward to where you thought you were going. Its Buyer Signals accuracy documentation describes exactly this wrapping behavior, and even notes that corporate security tools which "unwrap" URLs will cause under reporting of clicks.

Here is the detail almost nobody covering this tool has flagged, and it matters more than the mechanism itself. Cirrus Insight's IT allowlisting documentation tells admins to permit cirrustracking.com, described in the company's own words as "Used for Buyer Signals (Email/Link/Reply Tracking)." That is a separate registrable domain from cirrusinsight.com. The pixel, the wrapped link redirect, and reply monitoring all run through a hostname that does not contain the vendor's brand name at all.

The implication is direct. Anyone eyeballing a link before clicking, or any blocklist keyed to the obvious vendor domain, sails right past the traffic that matters. Wrapped links also survive every defense aimed at images: turning off remote image loading kills the open pixel and does absolutely nothing to a rewritten href. Our breakdown of how email link wrapping and click tracking work covers the redirect chain in full.

Does Open Data End Up in Salesforce?

The email itself does, clearly and by design. Whether each individual open event is written into a Salesforce activity record is something Cirrus Insight does not document publicly at field level, and it would be dishonest to claim otherwise.

What is documented: Cirrus Insight syncs messages into Salesforce against the Email Message object or the Task object, which is the entire reason companies buy it. Engagement data — opens, clicks, replies — surfaces in the Buyer Signals sidebar, where reps act on it without logging into Salesforce at all. Reply Tracking requires the top Expert plan tier per Cirrus Insight's knowledge base, the clearest published signal that engagement features cluster in the pricier tiers. Third party pricing pages disagree on the actual numbers, so treat any dollar figure you read about this product with suspicion.

Practically, assume the reading behavior persists somewhere the rep's manager can see it. Cirrus Insight's privacy and security page states it will "store and maintain Client data for up to 90 days after the termination of an applicable agreement" — meaning your open history outlives the vendor relationship that produced it. If you want the broader picture of how this data flows into a CRM, our piece on whether Salesforce is tracking your email walks through the destination side.

Why Email Users Should Care

Cirrus Insight is not a marketing platform, and that is what makes it worth understanding. Its pixels do not ride inside bulk campaigns with unsubscribe footers. They ride inside one to one messages written by a person, sent from a normal corporate address, looking exactly like ordinary correspondence. The follow up after a demo. The check in from an account manager. Nothing announces that a server logged your city and device the second it rendered.

The scale of the underlying practice was measured years ago and has only grown. A 2018 Princeton study by Steven Englehardt, Jeffrey Han, and Arvind Narayanan, published in Proceedings on Privacy Enhancing Technologies, examined over 12,000 emails from roughly 900 senders and found that 70% contained trackers. Sales tooling like Cirrus Insight extends that norm from mailing lists into personal conversation, where you have far less reason to be on guard.

The data is also unreliable in both directions, which Cirrus Insight admits. Its Buyer Signals accuracy guide notes that an alert fires "whenever the pixel is activated, not necessarily when the email is opened and read," and specifically calls out Apple Mail: Mail Privacy Protection downloads messages to Apple's servers, so "an open notification can be triggered when the message is initially downloaded." Sit with the asymmetry. The rep receives a number the vendor has warned them not to trust. You pay for that number in your location, your device, and your reading schedule.

How Do You Block Cirrus Insight Email Tracking in Gmail?

Three approaches work, and only one of them handles both halves of the problem.

1. Stop Gmail from loading external images

Click the gear icon, choose "See all settings," stay on the General tab, scroll to Images, select "Ask before displaying external images," and save. Per Google's documentation of the setting, nothing remote loads until you approve it, so no tracking pixel fires from any sender. The cost is permanent friction: every legitimate logo, product photo, and newsletter graphic now sits behind a prompt.

2. Understand why that is incomplete

Image blocking does nothing about wrapped links. Cirrus Insight's click tracking lives in the href, not in an image, so the redirect through cirrustracking.com fires the moment you click regardless of your image settings. Gmail's image proxy is not a fix either. Google fetching the pixel on your behalf hides your raw IP address, which defeats the location guess, but the request still happens and the open still gets counted. Mistaking the proxy for a tracking blocker is the single most common Gmail privacy misconception, and our guide to blocking email tracking in Gmail pulls that assumption apart in detail.

3. Strip the pixel and the tracking link before either loads

An extension running inside Gmail can remove tracking pixels before a message renders and clean tracking parameters out of links, killing the request without hiding the images you actually want. Gblock works this way, with a blocklist that updates automatically rather than shipping frozen inside the extension — which matters here specifically, because a vendor serving tracking from a domain like cirrustracking.com can add or rotate hostnames whenever it likes. To be straight about the limits: it is not an anti phishing tool, and it cannot catch a technique nobody has documented yet.

How Do the Alternatives Compare?

Gblock is not the only option, and being straight about the alternatives is more useful than pretending otherwise. Our full comparison of email tracker blocker extensions goes deeper, but the short version:

• Ugly Email flags tracked messages with an eye icon before you open them. Its detection list is community maintained, which historically means smaller vendors take longer to appear.
• PixelBlock shows a red eye when it catches a pixel. It focuses on pixels, so link wrapping sits outside what it addresses.
• Trocker is free and open source and marks tracked links as well as pixels, leaning on heuristics that can misfire on unusual senders.
• Proton Mail blocks remote content by default and proxies images, but it is a different mailbox — it does not protect a Gmail address you already use.
• HEY blocks trackers aggressively and names the offending company in the interface. Same caveat: it replaces your provider rather than defending the one you have.

Gblock's differentiators are narrow rather than sweeping: it runs inside the Gmail you already use, its blocklist updates automatically instead of shipping frozen in the extension, and it addresses tracking links as well as pixels. Against a tool serving both from a domain most people would never recognize, those are the properties that decide the outcome.

The Bottom Line

Cirrus Insight is more restrained than the tools built purely for outbound sales pressure, and the restraint changes almost nothing for you. Tracking ships off, but a user setting and an admin setting can both turn it permanently on. The pixel is transparent, the link is rewritten, and the traffic runs through a domain the company documents but never shows you. Nothing in the message itself tells you which configuration you are dealing with.

Blocking settles the question without asking anyone. The email still arrives, the images you want still load, the links still take you where they say — and the timestamp, the city, the device, and the count never leave your machine.

Sources: Cirrus Insight, Email Tracking FAQ, Cirrus Insight, How do I add Cirrus Insight to trusted/allowed lists, Cirrus Insight, Understanding Buyer Signals and the Factors that Impact Them, Cirrus Insight, Maximize Performance, Cirrus Insight, Admin Overview Guide, Cirrus Insight, How do I use Reply Tracking, Cirrus Insight, Trust, Privacy & Security, Englehardt, Han & Narayanan, I never signed up for this! Privacy implications of email tracking, PoPETs 2018, Google, Display images in Gmail, and Apple, Mail Privacy Protection.