Is ClickUp Tracking Your Email? How to Block It

Most articles about ClickUp email tracking would open by telling you a project management tool is spying on you. This one cannot, because ClickUp removed the pixel. Its help centre article on the Email ClickApp, updated on 31 July 2026, states it plainly: "To ensure compliance with the General Data Protection Regulation (GDPR), we no longer use a tracking pixel to display if an email sent from ClickUp has been seen." That is unusual enough to be worth saying out loud. The interesting part is what ClickUp did not remove. We read its policies and help docs, then probed its DNS and live servers on 22 September 2026.

Key Takeaways

• ClickUp's help centre states that it no longer uses a tracking pixel to show whether an email sent from a ClickUp task has been seen, citing GDPR compliance.
• The apex domain clickup.com publishes an SPF record with seven include lookups, authorising Google, Amazon SES, Zendesk, Qualtrics, Marketo, Salesforce and Zealot to send as ClickUp.
• On 22 September 2026, links.clickup.com answered with the header server: iterable-ingress, the fingerprint of Iterable's link tracking service, which records clicks and sets attribution cookies before redirecting.
• Adobe's own documentation says open tracking is enabled by default in Marketo, and clickup.com carries Marketo's standard m1 DKIM selector.
• clickup.com answers every nonsense subdomain with a wildcard DNS record, so track.clickup.com and tracking.clickup.com serve the ordinary marketing homepage and prove nothing.

Can a ClickUp User See That You Read Their Email?

Not through ClickUp itself. The Email ClickApp lets someone send you a message from inside a task and thread your reply back into that task, but ClickUp's own documentation says the open pixel is gone. The sender gets notified when you reply, provided they have ClickBot notifications switched on. They do not get notified when you merely look.

Their users are not happy about it. ClickUp's public feedback board carries standing requests to bring it back, including one asking for the number of times an email has been seen, mostly from sales teams who want to time their follow up. Demand has not moved the decision.

There is a catch the answer does not cover, and it matters more than the answer does. Email in ClickUp does not send from ClickUp's servers. The help doc lists the supported providers as Outlook, Gmail via OAuth, Microsoft 365 via OAuth and legacy IMAP, so the message leaves through the sender's own mailbox. Any tracker bolted onto that mailbox, and there are dozens, still fires. ClickUp removing its pixel removes ClickUp's pixel; it does not make the sender's Gmail account clean, which is the gap we mapped in email tracker Chrome extensions.

One more detail from the same page: Free and Unlimited workspaces carry a "Sent using ClickUp" watermark that Business plans and above can remove, so a paid plan's task email arrives unmarked.

Does ClickUp Track When You Open Its Own Emails?

This is the question ClickUp does not answer, and its policies are conspicuously narrow. The ClickUp privacy policy says only that "ClickUp and our third-party partners, such as our advertising and analytics partners, use cookies and other tracking technologies (e.g., web beacons, device identifiers and pixels) to provide functionality and to recognize you across different Services and devices." Not a word about email.

The cookie policy is narrower still. It defines "clear gifs, web beacons, web bugs" as "tiny graphics with a unique identifier similar in function to cookies" that are "embedded invisibly on web pages and are about the size of a single pixel," and scopes the document to "the tracking technologies we use on our sites." Every opt out it offers is a browser setting. None reaches an inbox.

Compare that with Canva, which states in writing that it puts clear GIFs in HTML emails. ClickUp makes no such statement in either direction. So we went looking at the infrastructure instead.

Which Vendors Are Authorised to Send as ClickUp?

Seven, and the SPF record names them. The apex domain publishes v=spf1 include:_spf.google.com include:amazonses.com include:mail.zendesk.com include:_spf.qemailserver.com include:mktomail.com include:_spf.salesforce.com include:_spf.joinzealot.com -all. Decoded: Google Workspace, Amazon SES, Zendesk, Qualtrics, Adobe's Marketo, Salesforce, and Zealot, which itself expands to include:mailgun.org. Seven includes, eight platforms once you unwrap the last.

The DKIM selectors add a ninth that SPF misses. s1._domainkey.clickup.com and s2._domainkey.clickup.com are CNAMEs into sendgrid.net subuser u24031397, and the legacy smtpapi selector is published too. SendGrid signs mail for clickup.com despite appearing nowhere in the SPF chain. For what that vendor does by default, see SendGrid open tracking.

The one that matters most is Marketo. m1._domainkey.clickup.com carries a live DKIM key, and m1 is Marketo's standard selector. Adobe's own documentation states that "email open tracking is enabled by default for both the Email Designer and the legacy email editor." Marketo also rewrites every link in a message so the click lands on Marketo's servers first. We covered the mechanism in detail in our write up of Marketo.

What Is links.clickup.com?

It is Iterable, and the server said so itself. Every request to links.clickup.com came back with the headers server: iterable-ingress and x-upstream: mobile-shortlinks, over a 404 page titled "Action not found." You rarely get a vendor name handed to you that cleanly.

The hostname fits the vendor's convention. Iterable's documentation says its default link tracking domain is links.iterable.com and recommends customers brand it to their own, which is exactly what links.clickup.com is. Iterable describes the hop without euphemism: users are "first taken to your link tracking domain," which tracks the click and "sets attribution-related cookies in the browser" before redirecting. The behaviour is the same one we documented in Is Iterable Tracking Your Email?.

So here is the honest shape of it. ClickUp turned off the pixel that would have let its customers measure you, and kept the two platforms that let ClickUp measure you. Different decisions about different beneficiaries, and only the first got written into a help doc.

The Host Named Track Is Not a Tracker

Anyone auditing ClickUp by guessing hostnames will embarrass themselves, so here is the trap. We asked DNS for zzq7clickupnope99.clickup.com, a name we invented, and it resolved cheerfully to four CloudFront addresses in 13.224.106.0/24. clickup.com runs a wildcard. Every subdomain resolves.

That kills the obvious evidence. track.clickup.com, tracking.clickup.com, click.clickup.com and em.clickup.com all return those same four addresses, and every one served an identical 143,193 byte page: the ClickUp marketing site. A host called tracking that serves the homepage is not a tracker. It is a wildcard.

Two hostnames broke the pattern, which is what made them readable. links.clickup.com sits in 52.84.143.0/24 and answers as Iterable; link.clickup.com sits in 13.32.220.0/24 and returned an empty HTTP 400 on every path, nonsense included, so we are not calling it either way. SPF records and DKIM selectors are published facts; guessed subdomains on a wildcard domain are noise.

What Does a Tracked Open Actually Report?

More than the word "opened" suggests. When your mail client fetches a tracking image, the request carries an identifier tying it to you and to that specific send, and the server logs the timestamp, the running count, the source IP address and the User-Agent string.

On a dashboard that becomes your approximate city, your device and operating system, your mail client, and what hour you read work email. Reopens are the part people underestimate. One open is a data point; nine across three days is a sales signal, which is exactly why ClickUp's users keep asking for the feature back.

Click tracking leaks something different. A rewritten link sends you to the vendor's server first, so it learns which link you chose before you reach the page, and Iterable adds attribution cookies on the way through. Spot one before you press it: hover over the link and read the status bar. If the domain is not the destination you expected, that is a logging hop. The habit works across senders, as we set out in Gmail read receipts and how to block them.

Does Apple Mail Privacy Protection Cover You?

Only if you read the message in Apple Mail, which most people reading work email do not. Apple's support documentation is accurate about it: with Protect Mail Activity on, "your IP address is hidden from senders and remote content is privately downloaded in the background," stopping senders learning "when and how many times you opened their email."

The mechanism is prefetching. Apple's proxy fetches every remote image the moment a message arrives, whether you open it or not, filling sender dashboards with opens that never happened. Protection by pollution rather than refusal, and it works. We measured the distortion in Apple Mail fakes half of all email opens.

It is also a setting in one app. Open the same ClickUp notification in Gmail on the web or on Android and Apple's proxy is not in the path at all. Gmail's image proxy is no substitute: it hides your IP behind Google's, but it still fetches the image, so the open is still recorded. Mail Privacy Protection is not a feature of your email address. It is a feature of one client.

How Do You Block ClickUp Email Tracking in Gmail?

Three layers, and they are not interchangeable.

• Cut the volume at the source. ClickUp's notification settings give the Email channel five options: Default, Focused, Mentions only, Custom and Disable notifications. Marketing mail is separate, via the communication preferences link in any ClickUp email or clickup.com/remove. Note that several triggers, including comments you are mentioned in, are marked "Cannot be deactivated."
• Gmail's external images setting. Settings, See all settings, General, then Ask before displaying external images and Save Changes. Free, and it stops every pixel including ones nobody has catalogued. Two honest limits: it breaks legitimate images too, so newsletters arrive as grey boxes, and it does nothing about rewritten links, which is the half Iterable handles.
• A blocker extension. The layer that handles both halves without breaking normal mail.

Compared honestly, since no one tool wins everything:

• Ugly Email. Open source, marks detected trackers with an eye icon and blocks the fetch. The visible warning is genuinely useful; the blocklist is curated by hand, so newly branded hosts arrive late.
• PixelBlock. Blocks pixel requests in Gmail and flags caught messages with a red eye. Stops the open, leaves rewritten links alone.
• Trocker. Marks pixels, warns before a tracked link resolves, and works across several webmail clients rather than Gmail only.
• Proton Mail and HEY. Both block remote images and strip spy pixels by default, and both do it well. Same cost either way: you move your mail somewhere else, which for a work address is rarely yours to decide.
• Gblock. Stays inside Gmail, blocks the pixel, and strips the tracking redirect out of links so pressing a button in a ClickUp email is not reported through Iterable first. The blocklist updates automatically, which is what matters for branded hosts like links.clickup.com that a hand maintained list can miss for months.

The trade offs are scored side by side in how to block email tracking in Gmail. One limit applies to all of them: none stops ClickUp knowing you logged in or opened a task. Blocking open tracking removes the inbox measurement, not the product telemetry.

What This Means for Your Inbox

ClickUp's decision sets a precedent worth holding other work tools to. A vendor looked at a feature its paying customers were actively requesting, decided the consent position was untenable, removed it, and wrote the reason into a public help page. That is more than Jira or Asana have put in writing.

It also shows where the pressure lands. ClickUp cited GDPR, and the floor moved again since: France's CNIL adopted a recommendation on tracking pixels in email on 12 March 2026, treating open rate measurement as a tracer requiring prior consent under Article 82, with enforcement after a 14 July 2026 deadline. Adobe shipped conditional open tracking in Marketo in response. We covered the deadline as it landed in France's 90 day ultimatum to email marketers.

For your inbox the reading is narrow and useful. A task email from a ClickUp user carries no ClickUp pixel, but it leaves through their Gmail or Outlook mailbox and whatever they installed on it. A marketing email from ClickUp itself travels through platforms whose defaults are open tracking and link rewriting. Blocking at the Gmail layer covers both at once, which beats auditing vendors one brand at a time.

What We Could Not Verify

Three gaps, stated rather than glossed. We did not capture a live ClickUp email and dissect its raw source, so we cannot show you a pixel URL from a real message. What we have is the vendor set ClickUp publishes in DNS, plus Adobe's statement about Marketo's defaults.

Second, the honest negative result: no probe of ours returned a transparent GIF from a ClickUp host. Marketo, SendGrid and generic open tracking paths against links.clickup.com and link.clickup.com gave HTML 404s throughout on one and empty 400s throughout on the other. Neither discriminated, so neither is evidence of a pixel. Open tracking may well be off in ClickUp's Marketo instance; we cannot show that it is on.

Third, ClickUp's help centre sits behind a Cloudflare challenge that refuses automated clients, so we read those articles through the public Zendesk content API. Both are linked above so you can check every quotation yourself.

Airtable runs the same Iterable click tracking on its own domain, as we found in Is Airtable Tracking Your Email?.