Is Postmark Tracking Your Email? How to Block It

Sometimes. Postmark email tracking is a switch the sender flips, not a default, and both halves of it are off until somebody turns them on. If the sender did turn them on, an invisible pixel in the HTML reports the moment you open the message and every link in it now points at click.pstmrk.it before it points at the real destination. The tell is that domain in your browser status bar. It is Postmark, it is legitimate infrastructure, and it is logging your city, your postcode, your browser and your IP address the instant you follow it.

Key Takeaways

• click.pstmrk.it is Postmark's link tracking domain, and Postmark states that link tracking "works by routing the links you place in the tracked emails through our tracking servers at click.pstmrk.it."
• Postmark's link tracking default is None, which the company documents as "No links will be replaced or tracked. This is the default setting for all messages and new and existing servers."
• Open tracking is also off unless enabled, because the API field TrackOpens defaults to false at both the server and the individual message level.
• Postmark's Open webhook payload carries Geo fields for Country, Region, City, Zip, Coords and IP, plus Client, OS, Platform and UserAgent.
• Individual open records are kept for 45 days according to Postmark's documentation, while "Aggregated statistics are stored forever."

What Is click.pstmrk.it?

It is the redirect host Postmark owns, and seeing it means the sender enabled link tracking on the email you are reading. Postmark's own support page about the domain says plainly: "Postmark is an email service provider and we use the pstmrk.it domain for link tracking, which provides analytics for Postmark customers."

The mechanism is a detour. Postmark scans the HTML and plain text bodies before delivery, swaps each destination URL for a wrapped one, and when you click, its servers log the request and forward you on. Postmark describes the routing as going "through our tracking servers at click.pstmrk.it." The redirect is fast enough that most people never register it happened.

Credit where it is due: pstmrk.it is one of the very few tracking hosts a recipient can recognise on sight, unlike a CRM such as Zoho, which does not publish its pixel hostname at all. The catch is that Postmark also lets senders point a CNAME at that infrastructure, so a wrapped link can just as easily read links.example.com. Domain spotting works right up until the sender pays for a custom domain, which is why our guide to how email link wrapping works tells you to read behaviour rather than memorise hostnames.

Does Postmark Track When You Open an Email?

Only if open tracking was switched on for that server or that specific message, and when it is, the method is the oldest one in the book. Postmark's developer documentation puts it in one sentence: "Sending emails with open tracking enabled will embed an invisible pixel into your emails that allows Postmark to record information when the email is viewed."

A tracking pixel is a one by one transparent image with a unique identifier in its URL. Your mail client fetches it to render the message, and that fetch is the report. Nothing is installed and no visible part of the email changes.

There is a real gap in the coverage, and Postmark admits it: "We can only add a tracking pixel to HTML emails. If you send plain text only emails or if a user only reads the plain text version, Postmark can't track opens." So a plain text password reset cannot carry an open beacon at all. It can still carry rewritten links, because link tracking has a TextOnly mode.

What Data Does Postmark Actually Record?

More than a timestamp, and the exact field list is public because Postmark documents its webhooks for developers. The Open webhook payload hands the sender's application these fields:

• Geo. CountryISOCode, Country, RegionISOCode, Region, City, Zip, Coords and IP. Postcode and coordinates, derived from your address, though Postmark notes Geo "may only be partially populated in certain cases."
• Client. Name, Company and Family, so which mail app you read in.
• OS and Platform. Operating system and whether you were on desktop, mobile or webmail.
• UserAgent. The raw string your client sent.
• FirstOpen. A boolean separating your first open from the reopens that follow.
• ReceivedAt. The timestamp, in ISO 8601 format.

The Click webhook repeats that same set and adds two fields of its own: OriginalLink, the destination you chose, and ClickLocation, telling the sender whether you clicked from the HTML or the plain text part of the message.

One detail deserves credit rather than alarm. Postmark says it "stores the information about individual opens for 45 days" while "Aggregated statistics are stored forever." That is a better retention posture than most senders bother to publish, and it helps you less than it sounds: the webhook already copied every one of those fields into the sender's own database on the day you opened, where Postmark's retention policy has no authority at all.

Is Postmark Tracking On by Default?

No, and this is the part most write ups get wrong. Both features start off and stay off until a developer or an admin changes something.

For links, Postmark's tracking links guide lists four settings, None, HtmlAndText, HtmlOnly and TextOnly, and describes None as: "No links will be replaced or tracked. This is the default setting for all messages and new and existing servers." For opens, the TrackOpens field defaults to false, so an email sent without that flag carries no pixel.

Both settings work at two levels. A server level toggle covers every message that server sends, and a per message flag on the API call or an SMTP header overrides it. One company can track its broadcasts and leave its password resets clean, or track everything, or track nothing. You cannot tell which from the outside, only whether this particular message is wrapped.

That default is a deliberate choice, not an industry norm. Its closest competitor inverts it: Mailtrap tracks opens by default the moment your sending domain verifies, so two transactional providers with near identical feature lists put you in opposite positions before anyone touches a setting. Resend, the developer API popular with startups, sits on Postmark's side of that line: tracking stays off until the sender enables it per domain.

Worth knowing who owns the pipe: Postmark was acquired by ActiveCampaign from Wildbit in May 2022. If a company sends you transactional mail through Postmark, the same organisation may well handle its marketing automation too, where ActiveCampaign's own tracking behaves very differently and the defaults are nowhere near as conservative.

Why Email Users Should Care

Postmark is transactional first. It carries receipts, shipping notifications, password resets, security alerts, invoices. These are not messages you skim and bin. They are the ones you open immediately, from wherever you happen to be, often on the phone, often at an odd hour, because something needs your attention right now.

That changes what an open signal is worth. A newsletter open tells a marketer their subject line worked. A password reset open, stamped with a city, a postcode and a device, tells whoever is reading the logs where you physically were at the moment your account needed attention. Same pixel, wildly different sensitivity. Nobody signs up for that when they click "forgot my password", and the message arrived because you asked for it, which makes any argument about implied consent thinner than it looks.

Then there is the noise. Security gateways prefetch remote images before a human sees anything, and Apple's Mail Privacy Protection has proxied remote content by default since 2021, which Postmark warns "can cause false-positive opens to be reported." The sender collects a number that is often wrong about you, and you still pay the full price of generating it. To check an inbox rather than guess, our walkthrough on how to detect email tracking pixels in Gmail shows what to look for in the raw message.

How to Block Postmark Tracking in Gmail

Stop the pixel from loading, understand why Gmail's image proxy is not enough, then deal with links as a separate problem. And the reassurance first, because it is the thing people actually worry about: blocking tracking does not block the email. The receipt still arrives, the reset link still works, the invoice still lands. You are refusing to file the report, not refusing the message.

1. Turn off automatic image loading. Click the gear icon in Gmail, choose See all settings, stay on the General tab, scroll to Images and select "Ask before displaying external images", then save at the bottom. No remote image loads without your approval, so no pixel fires, from Postmark or anyone else. Per Google's documentation for the setting, the cost applies everywhere: every logo, product photo and signature graphic in every other email now sits behind a prompt. Most people undo it inside a fortnight.

2. Do not mistake Gmail's image proxy for protection. Gmail serves remote images through Google's servers instead of letting the sender's host reach you directly, which masks your real IP and user agent. That is why a Postmark Geo object can end up pointing at a Google data centre rather than your street. But the fetch still happens: Postmark logs the open, the FirstOpen flag flips, the webhook fires. This is the most expensive misconception in Gmail privacy, and our full comparison of ways to block email tracking in Gmail works through each option properly.

3. Strip the pixel instead of hiding every image. An extension running inside Gmail can remove tracking beacons before the message renders, so the request never leaves your machine while normal images still display. Gblock works this way: it blocks known tracking pixel requests, strips known tracking parameters out of links, and pulls a fresh blocklist rather than shipping a frozen one. Straight about the limits, it is not an anti phishing tool, and no blocklist catches a technique nobody has documented yet.

Why image settings do nothing about clicks. A rewritten link is an ordinary anchor tag, so no image preference touches it. Hover first and read the status bar. If you see click.pstmrk.it, or any host unrelated to the page you expect, that hop is being counted. Postmark wrappers often show the destination encoded in the URL so you can go there directly, and an extension that strips tracking parameters handles the ones you cannot read.

Which Blocker Fits Your Setup?

Several tools solve parts of this and none of them solve all of it. Here is the honest version with what each one leaves on the table, and a fuller breakdown in our roundup of email tracker blocker extensions.

If leaving Gmail is off the table, the choice narrows to an extension, and the two differences that bite are blocklist freshness and whether the tool touches links at all. Half the tools above only handle pixels, which is exactly the half of Postmark tracking that Gmail's proxy already muddies. The link wrapping is the part that reliably works, and the part fewest tools address.

The Bottom Line

Postmark's defaults are better than the industry norm. Link tracking ships as None, open tracking ships as false, and individual open records expire in 45 days. That is a company that clearly thought about it. None of that helps you when the specific sender in your inbox flipped both switches, which you will never be told and can only infer from a hostname in a status bar. Block the pixel and the question stops mattering. Your receipt still arrives, your reset link still works, and the row with your postcode in it never gets written.

Sources: Postmark, What is pstmrk.it?, Postmark, How does Link Tracking work?, Postmark, Tracking links, Postmark, Tracking opens, Postmark, Open webhook, Postmark, Click webhook, Postmark, Acquired by ActiveCampaign, Google, Display images in Gmail, and Apple, Mail Privacy Protection.