Is Loops Tracking Your Email? How to Block c.vialoops.com

Is Loops tracking your email? If the message came from a campaign or an automated workflow, yes, and Loops says so in one flat sentence of its own documentation. The tracking runs neither on loops.so nor on the sender's domain. It runs on c.vialoops.com, a host whose name gives away nothing: not the company, not the purpose, and not Amazon, which is where it resolves. Everything below is reproducible from a terminal and from Loops' published docs.

Key Takeaways

• Loops' documentation states that "By default marketing emails (campaigns and workflows) have opens and link tracking enabled", with one switch under Settings then Sending that turns it off for the whole account.
• c.vialoops.com serves both the open pixel and the click redirect, and a HEAD request to https://c.vialoops.com/favicon.ico returns x-amz-ses-region: us-east-1, Amazon's own documented signature for a custom SES tracking domain.
• The domain vialoops.com was registered on 19 January 2022 through NameCheap behind the privacy service "Withheld for Privacy ehf".
• Transactional email is genuinely exempt: Loops' docs say "Links and opens in transactional emails are never tracked in order to improve deliverability", and the email.opened webhook does not fire for those sends.
• The email.opened webhook payload carries a contactIdentity object with the recipient's email address next to a unix eventTime, so an open is recorded against a person and a second, not as an anonymous count.

Does Loops Track Email Opens?

Yes, for marketing email, and it is already on before anyone touches a setting. The Loops documentation on links puts it in a single sentence: "By default marketing emails (campaigns and workflows) have opens and link tracking enabled. This can be disabled for all emails in Settings -> Sending."

Opens and clicks share one default, and the switch is account wide, so a sender measures everyone or nobody. There is no per recipient consent in the flow, and nothing in the message tells you how the account is set.

The carve out is real. Loops' transactional email guide says "we do not track opens or link clicks in transactional emails, to increase deliverability of your emails", and its behaviour table lists tracking as On for campaigns and workflows, Off for transactional. Your password reset carries no pixel. The product announcement almost certainly does.

What Is c.vialoops.com?

It is Loops' tracking host, and underneath the branding it is Amazon SES in the us-east-1 region.

A DNS lookup on 19 August 2026 resolves c.vialoops.com to dt5v5cokx8pmb.cloudfront.net, which is the architecture Amazon prescribes. AWS's guide to configuring custom domains to handle open and click tracking tells you to point a CDN at the SES tracking origin, "such as r.us-east-1.awstrack.me", then CNAME your subdomain to the CDN. The sibling host o.vialoops.com CNAMEs straight to r.us-east-1.awstrack.me.

AWS also publishes a validation command for anyone setting this up: request /favicon.ico and read the headers. Run it against Loops and no interpretation is required. curl --head https://c.vialoops.com/favicon.ico returns HTTP 200, a 43 byte image/x-icon, and the headers x-amz-ses-request-protocol: https and x-amz-ses-region: us-east-1. Any other path with an invalid token returns 400, which is what a live tracking endpoint does when a signature fails.

The mechanism is therefore Amazon's, in Amazon's words: SES "adds a 1 pixel by 1 pixel transparent GIF image in each email sent through SES which includes a unique file name for each email, and is hosted on a server operated by SES; when the image is downloaded, SES can tell exactly which message was opened and by whom." Clicks are rewritten to the shape /CL0/{encodedUrl}/{index}/{messageId}/{hmac}. A reader who reported a Loops pixel to uBlock Origin's filter list tracker in July 2024 posted one from a real message: a /CI0/ path over plain http://. That is the SES default rather than sloppiness, since Amazon's HttpsPolicy ships as OPTIONAL, under which "Open tracking links will be wrapped using HTTP".

From the registry: vialoops.com was created on 19 January 2022 through NameCheap, registrant hidden behind Withheld for Privacy ehf, and it serves nothing at the apex. It exists to be a name nobody recognises in a message source.

What Can the Sender Actually See?

Your email address, sitting next to a timestamp and a subject line, in a log the sender can filter and export.

The Loops webhooks reference is the clearest statement of granularity, because it shows the payload. An email.opened event carries an eventTime unix timestamp, a campaignId or loopId, an email object with the subject line, and a contactIdentity object with id, email and userId. There is no aggregation step.

Inside the app the same data drives two surfaces. The contact activity timeline shows a per person list of Sent, Opened, Clicked, Soft bounced, Hard bounced, Marked as spam and Unsubscribed. And audience filters and segments include activity filters for Opened ("contacts who opened a campaign or workflow email") and Clicked, saveable as a segment or exported to CSV. "Contacts who have opened a specific campaign" is a documented export example.

Why Is Loops Unusually Easy to Block?

Because every Loops customer on the planet shares the same tracking host, and there is no feature to change that.

Loops publishes its whole documentation corpus as one file at loops.so/docs/llms-full.txt. Downloaded on 19 August 2026 it runs to 939,808 bytes and contains zero occurrences of "tracking domain" and zero of "custom domain". Senders do verify their own sending domain, with records pointing at feedback-smtp.us-east-1.amazonses.com, but the measurement layer is not part of that. Loops' own security disclosure policy lists exactly three hosts in scope: loops.so, app.loops.so and c.vialoops.com.

That cuts in the reader's favour. Resend rewrites links through the sender's own subdomain, and EmailOctopus routes clicks through sptr.eocampaign1.com or a subdomain the sender verified themselves. In both cases a rule written for one sender tells you nothing about the next. With Loops, one host covers the platform. Coverage of email tracking usually treats vendor consolidation as bad news for privacy. Here it is the opposite: the single point of collection is also a single point of refusal.

The Part Loops Gets Right, and the Part That Does Not Add Up

Credit first. Never tracking transactional mail is a commitment many platforms do not make, the account wide off switch removes the whole apparatus rather than half of it, and the docs describe it without spin.

Then there is the guide Loops itself publishes, titled "Open rates are a vanity metric". It argues the number is "(mostly) just for show", that Apple Mail Privacy Protection inflates it, and defines the mechanism in an aside: "an email tracking pixel is a 1px by 1px square image that is inserted into an email and is transparent in color and invisible to the recipient." The segmentation docs go further, advising senders to use goals "instead of treating opens or clicks as the primary engagement signal".

All of that is correct, and it is also the argument against the default. A company that tells customers the metric is unreliable and better replaced still ships the collection switched on, on a host named after nothing, with the choice sitting with the sender rather than the person being counted. Our guide to detecting email tracking pixels in Gmail shows how to check a message yourself.

How Do You Block Loops Tracking in Gmail?

The open is an image request and the click is a redirect, so there are several places to intervene, plus one thing that stays out of reach.

• Turn off automatic image loading in Gmail. Settings, then General, then "Ask before displaying external images", a control Google documents in its own image settings help page. The SES pixel never loads, so no open event exists. The cost is that nothing loads, including images you wanted, and it does nothing about clicks.
• Block the host before your browser requests it. Because c.vialoops.com is fixed across every Loops account, one domain rule stops open tracking for the entire platform without touching normal images. Gblock strips tracking pixels out of messages inside Gmail before the request goes out.
• Do not click the rewritten link. Any Loops link you follow is a /CL0/ redirect through c.vialoops.com carrying a message id, so the click is attributed before you land. Reach the page from the sender's site instead, or let Gblock strip the link so the destination opens directly.
• Check a message before you assume. Search the raw source for vialoops. If it is absent, the sender turned tracking off, or the message is transactional and was never tracked.
• Know what none of this stops. Delivery, bounces, spam complaints and unsubscribes are recorded server side and no blocker touches them. You remove the open and the click, not your presence on the list.

How Does Gblock Compare to Ugly Email, PixelBlock and Trocker?

All four block pixels; the differences are coverage, upkeep and whether tracked links are handled at all. We compare them in detail in our roundup of the best email tracker blocker extensions.

Ugly Email is an MIT licensed extension that flags tracked Gmail messages with an eye icon and blocks the detected pixel, locally. Trocker is free and open source, works across several webmail providers, and is the only free tool here that marks tracked links and tries to route you past them. PixelBlock does plain pixel blocking, though its Manifest V2 history means you should confirm you have the maintained build. Proton Mail and HEY build protection into the client, which does not follow your mail into Gmail.

Gblock's difference is narrower than "better". It stays inside Gmail rather than asking you to move providers, it covers tracked links as well as pixels, and updates its blocklist itself, so a new sending platform does not require you to notice and act.

The Honest Summary

Loops is not the worst actor in email marketing. It exempts transactional mail outright, documents its behaviour without evasion, and tells its own customers the metric is mostly theatre.

It still measures your opens and clicks unless a sender switches it off, through Amazon SES event publishing, on a domain registered behind a privacy service four years ago that identifies neither party. The row with your address and a timestamp exists because your mail client fetched an image. That fetch is the only part of this on your side of the wire, and the only part you get a vote on.