Is Jira Tracking Your Email? How to Block It

Most questions about jira email tracking get answered with a shrug, because Atlassian is really two mail operations wearing one logo. Your issue notifications leave from yoursite.atlassian.net. Atlassian's marketing leaves from e.atlassian.com. Different domains, different vendors, different tracking. We resolved the DNS for both, checked who owns the netblocks at ARIN, pulled every mail related hostname out of certificate transparency, and sent live requests at the endpoints we found. One of the two streams answered with a tracking pixel.

Key Takeaways

• On 22 September 2026, the host click.e.atlassian.com answered Salesforce Marketing Cloud's open tracking path with HTTP 200 and a 43 byte GIF89a image measuring one pixel by one pixel, while a nonsense path on the same host returned a 1,245 byte 404.
• Atlassian's Cookies and Tracking Notice states that Atlassian uses these technologies "to determine whether an email has been opened and acted upon" and calls web beacons by their other name, "tracking pixels."
• Jira Cloud issue notifications come from jira@yoursite.atlassian.net, a domain authorised only for SparkPost, SendGrid and Amazon SES, and we found no branded open tracking host on it that survived a wildcard control.
• Atlassian's marketing mail runs on at least two martech platforms at once: Salesforce Marketing Cloud on e.atlassian.com and mailer.atlassian.com, and Adobe Marketo on eml.atlassian.com.
• Atlassian's privacy policy confirms that opting out of promotional mail does not stop transactional mail, so some Atlassian email arrives whether you consent or not.

Does Jira Track When You Open a Notification Email?

On the evidence we could gather, no, and this is the rare case where the boring answer is the honest one. Jira Cloud sends issue notifications from jira@yoursite.atlassian.net, as Atlassian's own notification documentation states. That domain has its own sending policy, and it is a short one.

The SPF record on atlassian.net chains three includes and then slams the door with -all. Follow each one and the vendor list is:

• SendGrid and Amazon SES. _spf.atlassian.net authorises 167.89.0.0/17 and 168.245.0.0/17 plus amazonses.com. We checked the first block at ARIN rather than assuming: it registers as SENDGRID-167-89-0-0-17, organisation SendGrid, Inc.
• SparkPost, twice. mail-us.atlassian.net is a CNAME to atlassian.mail.e.sparkpost.com and mail-eu.atlassian.net to atlassian-eu.mail.e.sparkpost.com. Both publish SparkPost's distinctive exists:%{i}._spf.sparkpostmail.com macro. That is a deliberate split between US and EU sending regions.

Every one of those vendors is perfectly capable of open tracking, and each has its own pixel host when a customer switches the feature on, which we have documented for SendGrid and SparkPost. Capability is not use. We hunted for a branded tracking host on atlassian.net and found nothing we could stand behind, for a reason worth explaining.

Why a Hostname Guess Proves Nothing Here

Because atlassian.net answers to everything. Ask it for click.atlassian.net, track.atlassian.net or email.atlassian.net and all three resolve to 13.227.180.4. So does zzq7nope99.atlassian.net, and so does totallyfake12345.atlassian.net. It is a DNS wildcard pointing at an Amazon address, and it means any "tracking host" you discover by guessing names on that domain is an artefact of the wildcard, not a finding.

This is where a lot of amateur tracker hunting quietly goes wrong. A resolving hostname feels like proof. Run the nonsense control and half of those discoveries evaporate. We hit the mirror image of this problem auditing Canva's mail estate, where a host actually named tracking turned out to be a parcel service and the real pixel sat on an innocuous name.

Now run the same control on the other domain. zzq7nope99.atlassian.com returns NOERROR with zero answers: no A record, no CNAME, nothing. There is no wildcard on atlassian.com. Every hostname in the next section is therefore real, deliberately created, and worth taking seriously. Same company, two domains, two completely different standards of evidence.

What Does an Atlassian Marketing Email See?

It sees the open, and we have the bytes. The host click.e.atlassian.com is a CNAME to click-sap.sfmc-marketing.com, which is Salesforce Marketing Cloud, the platform formerly called ExactTarget. We requested Marketing Cloud's standard open tracking path on it, /open.aspx?ffcb10-abc123, and got back HTTP 200 with content-type: image/gif and a body of exactly 43 bytes. The header reads GIF89a and the two little endian shorts after it decode to width 1, height 1. A single invisible pixel, served live on an atlassian.com hostname.

Two controls keep that honest. The nonsense path /zzznonsense9182 on the same host returned 404 with a 1,245 byte HTML page, so the pixel endpoint is purpose built rather than a catch all that answers anything. And /?qs=abc123 returned HTTP 302, which is a working click redirector turning away an unsigned token rather than an empty address.

A 43 byte image is a strange thing to think about. It is smaller than this sentence. It carries no picture anyone will ever see, and its entire job is to make your mail client place a request that says: this person, this message, right now. What comes back to the dashboard is the timestamp, the number of times you reopened it, the IP address your client used and the approximate location derived from it, plus the user agent naming your mail app and device. We break the mechanism down further in open tracking versus click tracking.

The rest of the marketing estate lines up behind it. e.atlassian.com publishes v=spf1 include:cust-spf.exacttarget.com -all and takes replies at inbound-reply.s1.exacttarget.com. Its siblings view.e.atlassian.com, image.e.atlassian.com and cloud.e.atlassian.com all point into Marketing Cloud infrastructure, the images through Akamai. An older host, click.mailer.atlassian.com, is still a CNAME to click.virt.exacttarget.com. The vendor behaviour is the same wherever it sits, which we cover in Salesforce Marketing Cloud tracking.

And there is a second platform. links.eml.atlassian.com is a CNAME to mkto-ab350042.com, an Adobe Marketo branded link domain. Our probe there did not discriminate, so we treat it as DNS evidence of Marketo in the stack rather than a proven live pixel; Marketo's tracking behaviour is documented separately.

How Do You Spot a Rewritten Link Before You Click?

Hover over it and read the domain, because a rewritten link never shows you its destination. Click tracking works by replacing every URL in the message with one pointing at the sender's logging host, carrying an opaque token that identifies you and the link. The server records the click and issues a redirect, which is precisely the HTTP 302 we got from click.e.atlassian.com/?qs=abc123.

In practice that means a link labelled "read the release notes" in an Atlassian marketing email does not go to atlassian.com first. It goes to click.e.atlassian.com, which notes the hit and forwards you on. The tell is the hostname in your browser's status bar: a click. or links. prefix followed by a long random string in the path. The redirect hop is fast enough that you will never see it happen.

The useful contrast: a Jira issue notification links straight to your site's issue URL. No interstitial host, no token. If you want to verify a specific message rather than trust us, open it in Gmail, use the three dot menu, choose Show original and search the raw source for click.e.atlassian.com. Search the hostname, not width=1, the advice repeated everywhere else; we have caught trackers shipping a 2x2 image purely so that search fails.

What Does Atlassian Say It Does?

It says the quiet part in writing, just not in the document most people read. Atlassian's Cookies and Tracking Notice states that Atlassian and its third party partners collect information using web beacons, glossed in the notice itself as "tracking pixels", and that these technologies are used "to determine whether an email has been opened and acted upon." Opened and acted upon is both halves of the measurement: the pixel and the rewritten link.

The privacy policy handles the escape hatch, and it is narrower than it looks: "Even after you opt out from receiving promotional messages from us, you will continue to receive transactional messages from us regarding our Services." The cookie preference controls Atlassian offers live in Atlassian Account under Privacy, and they govern cookies on the web properties. Nothing there is a switch for the pixel in an email that has already been sent to you.

Disclosure is not consent. A sentence in a tracking notice tells you the practice exists; it does not give you a way to decline it while still getting the mail.

Why an Open Signal Is Worth More at Work

A consumer open tells a retailer you might buy a jumper. A work open tells a B2B vendor which named account is warming up, and that is a far more valuable record. Marketing Cloud and Marketo both exist to roll individual engagement up into account level scoring, feed it to a CRM, and route the account to a sales team when the number crosses a threshold. Your open is not a lonely data point; it is a row under your employer's name.

Consider the asymmetry in volume. Jira notification mail is some of the highest frequency correspondence in an engineering organisation, and it is genuinely wanted. Atlassian product announcements are low frequency and largely unwanted. The tracking sits on the second category. That inverts the intuition most people carry, which is that the noisy automated stuff must be the surveillance and the occasional newsletter must be harmless. On this estate it is exactly backwards, and both streams land in the same inbox, often in the same thread view, under the same Atlassian sender name.

For anyone with a compliance remit, the wrinkle is jurisdictional. France's CNIL and Italy's Garante have both landed on prior consent for open rate pixels, treating a beacon in an email the way ePrivacy treats a cookie. An Atlassian marketing email opened by an employee in Lyon involves a tracking technology that European regulators increasingly think needed permission first. The same Marketing Cloud pattern shows up across the enterprise SaaS vendors we have tested, including Asana and Notion, so an inbox full of work tools is an inbox full of the same handful of martech vendors wearing different logos.

How Do You Block Jira Email Tracking in Gmail?

Three layers, and they solve different parts of the problem. Start by cutting the volume, because mail that never arrives cannot be measured. In Jira personal settings, open Notification settings and switch off "Send me emails for work item activity", or clear every checkbox except the mentions you care about. Atlassian notes the honest limit: your preferences act as a filter on top of what your admin configured, so some notifications survive regardless.

Then stop the pixel loading. Honestly compared:

• Gmail's own image setting. Settings, General, then Ask before displaying external images. Free and thorough, and it breaks every image you wanted as well as the one you did not. It also does nothing about rewritten links. Do not mistake Gmail's image proxy for protection either: it hides your IP behind Google's, but it still fetches the pixel, so the open is still recorded.
• Apple Mail Privacy Protection. On iPhone, iPad and Mac, Apple routes remote content through two relays so that, in Apple's description, senders cannot see your IP address or whether and when you opened the message. It only covers mail read in Apple Mail, not Gmail in a browser.
• Ugly Email. Open source, flags detected trackers with an eye icon in the message list before you open anything. The blocklist is curated by hand, so branded hosts take time to land.
• PixelBlock. Blocks the pixel request in Gmail and marks caught messages with a red eye. Stops the open, leaves rewritten links alone.
• Trocker. Marks pixels and warns before a tracked link resolves, and works across several webmail clients rather than Gmail only.
• Proton Mail or HEY. Both strip spy pixels by default and both do it well. The cost is identical either way: you move your mail off Gmail, which is rarely an option for a work account.
• Gblock. Stays inside Gmail, blocks the pixel, and strips the tracking redirect out of links so opening a release note from an Atlassian email is not reported on the way through. The blocklist updates automatically, which is what matters against branded hosts like click.e.atlassian.com that a hand maintained list can miss for months.

We scored these side by side in how to block email tracking in Gmail, and catalogued the tools aimed the other way in email tracker Chrome extensions.

What This Means for Your Inbox

The Atlassian result is a useful corrective to a lazy assumption. People audit their inbox by brand, decide that the tool sending forty emails a day must be the problem, and never look at the quarterly product announcement. Here the forty emails a day are, as far as we could establish, clean, and the quarterly announcement carries a live 43 byte pixel on a Salesforce host. Volume and surveillance are unrelated.

It also generalises further than Atlassian. Marketing Cloud gives every customer the same /open.aspx endpoint on their own branded subdomain, so a filter matching that path shape catches thousands of senders whose names you have never audited, while a filter matching the string "atlassian" catches one. The vendor stays constant and only the label in front changes, which is why Proton's Spam Watch analysis could find trackers in roughly 80% of promotional mail: it is not 80% of companies each building something, it is a handful of platforms serving all of them.

Blocking it costs you nothing you want. The announcement still arrives, the release notes still open, your tickets still reach you. What disappears is the request telling a dashboard that a particular person at a particular company looked, at 9:14 on a Tuesday, from a phone. Because that pixel loads with the ordinary remote images in HTML mail, blocking it at the Gmail layer handles every sender at once rather than one brand at a time.

What We Could Not Verify

Four gaps, stated rather than glossed. We did not capture a live Jira notification from a real site and dissect its source, so our finding on the atlassian.net stream is an absence of evidence from DNS and certificate transparency, not a guarantee that no pixel exists. Open tracking can be switched on per message in any of these platforms without a new hostname appearing anywhere we can see.

Second, link.notifications.atlassian.com is a real host in certificate transparency and a CNAME to a CloudFront distribution, sharing that distribution with link.engagement.atlassian.com. Every request we sent it failed at the connection layer, so we have a suggestive name and no data. We are not calling it a tracker on the strength of a label.

Third, the Marketo host returned an identical 200 response with a 539 byte "page not found" body for both our test path and our nonsense control. A probe whose treatment and control answer the same way proves nothing, so Marketo is in this article as DNS, not as a confirmed pixel.

Fourth, one oddity we cannot explain and will not dress up: automation.atlassian.com publishes v=spf1 -all, a record that authorises nothing on earth to send mail as that domain. Jira automation rules do send email, so either that mail leaves under a different domain or the record is a deliberate lockdown of a name that only ever appears in link URLs. Both readings are plausible and we did not test which is true.

Atlassian's other big product tells a different story: Trello runs its own SparkPost tracking host, as we found in our Trello email tracking audit.