Is Mandrill Tracking Your Email? How to Block It

You hovered over a link in an order confirmation and the status bar showed something you did not expect: mandrillapp.com. Not the store you bought from. Not a domain you recognize at all. That is Mandrill, Mailchimp's transactional email service, and seeing it in a link preview usually means email tracking is switched on for that message. The receipt you assumed was a plain notification is quietly reporting back.

Key Takeaways

• Mandrill is the original name of Mailchimp Transactional, a paid add on that sends one to one mail such as receipts, password resets and shipping notices.
• Mailchimp Transactional tracks opens by adding a 1 pixel square graphic at the bottom of HTML emails, and click tracking is enabled by default for both HTML and text messages.
• By default both the open tracking image and every rewritten link point at mandrillapp.com, which is why that domain appears in your inbox.
• Senders can move tracking onto their own subdomain with a CNAME record, so a message can be tracked by Mandrill without the word "mandrill" appearing anywhere in it.
• Mailchimp's documented activity fields expose open timestamps, clicks per link, IP addresses, geolocation and user agent to the sender.

What Is Mandrill and Why Is It in My Inbox?

Mandrill is Mailchimp's transactional email product, now formally called Mailchimp Transactional. Mailchimp's own developer documentation acknowledges the naming overlap directly: "you may notice the occasional reference to the product's original name, Mandrill. Mandrill is in the process of being fully integrated into Mailchimp proper."

The distinction Mailchimp draws between its two products matters here. Regular Mailchimp handles bulk campaigns and list management. Mailchimp Transactional handles the one to one messages triggered by something you did: a purchase, a signup, a password reset. It is not a free tier product. It runs as an add on requiring a Standard or Premium Mailchimp plan, sold in blocks of emails.

So when mandrillapp.com shows up in a receipt from a small retailer, nothing sketchy is happening. That retailer pays Mailchimp to deliver its notifications, and the tracking infrastructure comes attached. If you have already read our breakdown of how Mailchimp tracks opens in marketing campaigns, this is the same company applying the same technique to a different class of mail.

Why Does Tracked Transactional Mail Matter More?

Because transactional mail is the mail you trust, and trust is what makes the signal valuable. Nobody opens an order confirmation with their guard up, and nobody thinks twice about clicking the tracking number in a shipping notice.

The numbers support that. Brevo's 2026 Marketing Orchestration Benchmark, built on first party data from more than 175,000 customers, put automation and transactional email at a 30.63% open rate with a 7.39% click through rate, against a 20.73% open rate for marketing email. A sender running open tracking on receipts is collecting engagement signal at a substantially higher rate than the same tracking on a promotional blast.

Here is the part most email tracking coverage skips. Marketing tracking has an escape hatch: you unsubscribe, the mail stops, the tracking stops. Transactional mail has no such hatch. You cannot unsubscribe from your own password reset. If a company enables open tracking on its security alerts and its receipts, it accumulates a timestamped record of when you were at your device, and the only way out is to stop doing business with them.

How Does Mandrill Track Email Opens?

Mandrill tracks opens with a tracking pixel. Mailchimp's activity and reports documentation states it plainly: "Mailchimp Transactional tracks opens by adding a 1-pixel square graphic at the bottom of HTML emails."

The mechanism is the same one used across the entire email industry. Your mail client renders the HTML, reaches the invisible image, and requests it from Mandrill's server. That request carries your IP address and your user agent string, and it arrives with a message identifier that ties the request back to you specifically.

What Mandrill's reporting hands the sender is more than a yes or no. The documented activity fields include opens.ts, a Unix timestamp for each open; opens.location for geolocation; opens.ua for the detected user agent; and opens.ip for the address the open came from. Every one of those has a matching clicks. equivalent. That is not a read receipt. That is a log of when you read it, on what, and roughly from where.

What Does a Mandrill Click Tracking Link Actually Do?

A Mandrill click tracking link routes you through Mandrill's servers before delivering you to the real destination. Mailchimp's documentation confirms click tracking "is enabled by default for both HTML and text emails," applied to links inside anchor tags.

Community reverse engineering work, including a well known gist on decoding Mandrill click links, documented what rides along in the URL. The link carries a base64 encoded parameter containing a signed JSON payload, and inside that payload sit the sending account ID, the message UUID, link identifiers, and the original destination.

That structure means the destination is not hidden from you. It is right there, encoded. It also means the redirect fires before you arrive, logging which link in which message you clicked, and when. Senders can suppress rewriting on a specific link with a disable tracking attribute, but that is their choice, not yours.

Can You Tell If a Given Email Is Tracked?

Not from the outside, no. Open and click tracking are per message settings controlled entirely by the sender. Mandrill's send API accepts track_opens and track_clicks as boolean flags on each message, and account level defaults can be overridden per message through the API or SMTP headers.

Two receipts from two different companies, both sent through Mandrill, can have completely different tracking behaviour. One might rewrite every link and embed a pixel. The other might do neither. Nothing in the subject line, the sender address or the visible body tells you which is which.

Which is why checking the source is the only reliable answer:

• In Gmail on desktop, open the message, click the three dot menu and choose Show original.
• Search the raw source for mandrillapp.com. Hits on an open tracking path indicate a pixel; hits on a click tracking path indicate link rewriting.
• Search for width="1" or height="1" to surface pixel sized images regardless of who serves them.
• Before clicking anything, hover the link and read the status bar. A redirect through an unfamiliar domain is the tell.

Our walkthrough on detecting tracking pixels in Gmail covers the same inspection process in more detail, and it works identically for Postmark, SendGrid and every other sending platform.

What About Custom Tracking Domains?

This is the catch, and it undermines any blocking approach keyed on a single domain name. Mailchimp lets senders route tracking through their own subdomain instead of mandrillapp.com. The setup is a CNAME record pointing something like clicks.example.com at Mandrill, plus a matching entry in the account's tracking domain settings. The API even exposes an add tracking domains endpoint to automate it.

Once configured, the pixel and the rewritten links carry the sender's brand. The tracking still runs through Mandrill. Nothing visible changes for the recipient except that the word "mandrill" disappears.

Be clear eyed about what that means. A blocklist that matches mandrillapp.com catches the default configuration and misses every custom tracking domain. This is not a Mandrill specific weakness. It applies to every sending platform and every blocker, Gblock included. An IEEE study of 44,000 emails found pixel blockers are evaded more easily than most users assume. Domain matching is a good filter, not a guarantee.

How Do You Block Mandrill Tracking in Gmail?

Four approaches, with honest tradeoffs for each.

Turn off automatic image loading. Gmail has a setting called "Ask before displaying external images" under Settings, See all settings, Images. It stops the pixel from firing until you approve images for a message. It also breaks every legitimate image in every email you receive, and it does nothing whatsoever about click tracking. Those links still redirect.

Apple Mail Privacy Protection. If you read mail in Apple Mail, MPP proxies image loads through Apple's relays, masking your IP address and decoupling the fetch from your actual open. Two limitations matter. It prefetches content whether or not you open the message, so the sender still records something. And it does not apply to Gmail in a browser, which is where most people read mail.

Strip the redirect by hand. Right click a tracked link, copy the address, and pull the destination out of the payload rather than following the redirect. Workable for one link. Unworkable as a habit.

Blocker extensions. Ugly Email flags tracked messages with an eye icon in the inbox list before you open them. PixelBlock blocks open pixels but leaves tracked links intact. Trocker uses heuristic detection across multiple webmail providers and highlights where the pixel sits. Each does a real job, and each has gaps. Our full Gmail tracking blocker comparison lays them side by side.

Gblock sits in that same category. It runs inside Gmail without switching clients, maintains an auto updating blocklist so newly identified tracker domains get added without you doing anything, and strips tracking links so the redirect never fires rather than only neutralizing the pixel. That last part is the piece PixelBlock does not cover. What it cannot promise: no blocker catches custom CNAME tracking domains reliably, and no blocker catches 100% of trackers. Anyone claiming otherwise is selling you something.

Is Tracking Transactional Email Even Legal?

The comfortable assumption, that you asked for the receipt so you consented to the tracking, is contested rather than settled.

Under US law, the FTC's CAN-SPAM compliance guide treats transactional or relationship messages as exempt from most of the Act's requirements, leaving only the prohibition on false or misleading header information. CAN-SPAM was written about unwanted commercial mail, though. It says nothing about embedded pixels either way.

Europe reaches a different place. The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive concluded that a tracking pixel instructs the recipient's device to send information to a remote server, placing it inside the consent requirement. That analysis turns on the technical act of accessing terminal equipment, not on whether the message was solicited. Consenting to receive a shipping notice is not, under that reading, consent to be measured while reading it.

Until that question is settled, the practical answer stays the same as it always was: check the source, block what you can, and know that "transactional" was never a synonym for "untracked."