Roundcube Read Receipts: Does Roundcube Track Your Email?

A Roundcube read receipt never goes out on its own in a stock install. When a message asks for one, Roundcube shows a prompt and waits for you. Remote images, the usual home of tracking pixels, are blocked until you click. Both facts come straight from the project's own defaults.inc.php configuration file, which we read on the master, release-1.6 and release-1.7 branches on October 27, 2026. So does Roundcube track your email? We found nothing in the code that reports your reading to senders without your say. The gaps are elsewhere: one click on Allow sends your real IP address to the sender's image server, tracked links pass through untouched, and the host running your webmail can change every default we describe here.

Key Takeaways

• Roundcube ships with show_images set to 0 (never, always ask) and mdn_requests set to 0 (ask the user) on its master, 1.6 and 1.7 branches.
• Roundcube has no image proxy: once you allow remote content, its HTML sanitizer passes image URLs to your browser unchanged, so the sender's server sees your IP address.
• Roundcube does not strip tracking parameters or redirect wrappers from links, so link click tracking works even when images stay blocked.
• Roundcube security releases between February 8 and October 19, 2026 fixed 10 separate ways a crafted email could get around remote image or content blocking.
• Hosts can override the defaults: ICDSoft's knowledge base, for example, lists from known senders as its default for remote resources instead of never.

Who Makes Roundcube, and Why Does Your Host Matter?

Roundcube is a free, open source webmail program that your provider installs on its own servers, and Nextcloud has owned the project since late 2023. The project's November 30, 2023 announcement says Nextcloud "assumed ownership of the project organization" after founder Thomas Bruederli stepped back. That makes it a takeover of the project, not a loose partnership.

The current versions are 1.7.5 and 1.6.20, both released on October 19, 2026. Since 1.7.0 shipped in May 2026, the 1.6 line has been in long term support mode, receiving only important security fixes.

Here is the catch for anyone answering the tracking question: you rarely run Roundcube yourself. Your web host, university or mail provider does, and they write their own config.inc.php on top of the defaults. ICDSoft's help page on remote resources lists the choices as "never, from known senders (default), and always," so on that host, mail from a known sender loads images automatically. We could not find DreamHost, Hostinger, OVH or cPanel documentation stating their Roundcube defaults, so we make no claims about them. Check your own settings page; it shows the value your host chose.

What Happens When a Tracked Email Arrives in Roundcube?

The tracking pixel is swapped for a placeholder and never fetched, unless you click Allow. Roundcube's HTML sanitizer, rcube_washtml, checks every image URL. With remote content blocked, it replaces any http or https image with a local placeholder, blocked.gif, and flags the message. You then see the notice from Roundcube's English message strings: "To protect your privacy remote resources have been blocked."

That notice has an Allow button. If your setting is from my contacts or from trusted senders, a second button appears: "Always allow from" followed by the sender's address. With the stock setting of never, that second button does not show at all, so there is no one click path to whitelist a newsletter for good.

Clicking Allow is the moment tracking happens. We traced the code path: when remote content is allowed, wash_uri() simply returns the original URL. Your browser then requests each image directly from the sender's server, pixel included. The server logs your IP address, browser and the time of the open. Roundcube does run external stylesheets through a server side CSS proxy (its October release notes mention a size limit for it), but images get no such treatment.

Does Roundcube Send Read Receipts Automatically?

No, not with default settings. A read receipt, formally a message disposition notification (MDN), is requested through a Disposition-Notification-To header. The standard, RFC 8098, calls that header "merely a request for an MDN" and says mail programs are "always free to silently ignore such a request."

Roundcube's mdn_requests setting decides what happens. The defaults file lists seven values:

• 0, ask me (the default): a dialog reads "The sender of this message has asked to be notified when you read this message. Do you wish to notify the sender?"
• 1, send receipt: confirms every request silently.
• 2, ignore request: never sends and never asks.
• 3 and 4: send automatically to your contacts, otherwise ask or ignore.
• 5 and 6: send automatically to trusted senders, otherwise ask or ignore.

Two details from the source code matter. First, Roundcube only raises the request on a message that is still unread and has no receipt already sent, so the dialog appears once. Second, the outgoing side defaults to private too: mdn_default is 0, which leaves the Return receipt box unticked when you compose. Where the setting lives has moved. In Roundcube 1.4 it sat under Mailbox View, which is why older host guides send you there. In 1.6 and 1.7 the dropdown, labeled On request for return receipt, is under Settings, Preferences, Displaying Messages.

What Can Senders Still Learn?

Senders can still learn that you clicked a link, and when. Roundcube's wash_link() function keeps link targets exactly as they arrive. A newsletter that wraps every link in a redirect through its email platform, with your subscriber ID in the URL, counts your click no matter how strict your image settings are. Our guide to how to block email tracking in Gmail explains how those redirects work.

Roundcube does help in one narrow way. It adds target="_blank" and rel="noopener noreferrer" to links in messages, so the destination site does not receive your webmail URL as a referrer. That protects your session address. It does nothing about the tracking ID baked into the link itself.

Is Roundcube's Image Blocking Reliable?

Only on a patched server. We counted every remote image or remote content blocking bypass listed in Roundcube's 2026 security announcements. There were 10 of them, spread over 7 of the 8 security releases between February and October:

• February 8: a bypass via SVG content.
• March 18: two, via SVG animate attributes and a crafted body background attribute.
• March 29 and May 24: one each, via SVG fill and stroke attributes and via CSS var().
• August 9: one, via an unclosed url().
• September 6 and October 19: two each, including a CSS escapes bug fixed "again" in October.

Each bypass is a way for a crafted email to load a remote image even when your setting says never. That is exactly what a tracking pixel needs. Most coverage of Roundcube security focuses on account takeover bugs, like the actively exploited flaw in our Roundcube SQL injection report or the campaign against Ukrainian prosecutors' Roundcube mailboxes. The quieter lesson is about privacy: a host still running 1.6.12 has the never setting on screen and up to ten known holes underneath it. In most installs, Settings, About shows the version.

How to Lock Down Roundcube Against Tracking

These steps use the labels from Roundcube's English interface strings for versions 1.6 and 1.7. Your host's skin or language may word them differently.

1. Block remote content. Settings, Preferences, Displaying Messages, Allow remote resources (images, styles): choose never. From trusted senders is a reasonable middle ground; from my contacts includes every address you have ever written to.
2. Refuse read receipts. Same page, On request for return receipt: choose ignore request, or keep ask me if you sometimes want to confirm.
3. Leave outgoing receipts off. Settings, Preferences, Composing Messages: keep Always request a return receipt unticked.
4. Treat Allow as a read receipt. On marketing mail, clicking it confirms your open and reveals your IP address.
5. Hover before you click. Your browser shows the real link target; long redirect domains are a sign of click tracking.
6. Ask your host for the version. Anything older than 1.6.20 or 1.7.5 misses the October 2026 blocking fixes.

What Should Self Hosters Put in config.inc.php?

Self hosters can enforce private defaults for every user with four keys. All of them are documented in the defaults.inc.php file:

• $config['show_images'] = 0; blocks remote resources and always asks.
• $config['mdn_requests'] = 2; ignores receipt requests without asking, or keep 0 to let users decide.
• $config['mdn_default'] = 0; leaves the outgoing receipt box unticked.
• $config['dont_override'] = ['show_images', 'mdn_requests']; stops users from loosening either setting. The settings code skips any key listed here.

One more interaction: the remote resources dropdown is disabled when prefer_html is false, because plain text views load no remote content. Patching matters more than any of these keys. Subscribe to the project's security announcements and update within days, not quarters.

Roundcube vs Gmail vs Gblock: An Honest Comparison

Roundcube with remote content off beats stock Gmail on open tracking, and Roundcube users do not need Gblock for pixels. Gmail went the other way in 2013. Its Images Now Showing announcement said Gmail would serve all images through Google's own secure proxy servers. Google's current image settings help page states: "By default, when you get an email with an image, you'll see the image automatically," and admits that "senders may know whether you've opened an email that has an image."

• Roundcube, defaults: pixel never loads unless you allow it; read receipts need your yes; links untouched; your IP leaks if you click Allow.
• Gmail, defaults: pixel loads through Google's proxy, so the sender gets the open and its time but not your home IP; links untouched.
• Gmail with Gblock: known tracking pixels are blocked while other images still display, and tracking is stripped from links. Gblock is a paid Chrome extension for Gmail on desktop browsers. It does nothing inside Roundcube.

If you read Roundcube mail in Roundcube with images set to never, the remaining gap is link tracking. If you forward Roundcube mail to Gmail, Gmail's rules take over. Our roundups of email tracker Chrome extensions and the Posteo read receipts review cover the alternatives, and the Thunderbird read receipts guide covers reading the same IMAP account on desktop.

Why Email Users Should Care

Roundcube is often the inbox people do not realize they are using. It is the webmail link inside a hosting control panel, the university login page, the small business mailbox nobody set up on purpose. Those users inherit whatever their host configured, and they rarely open Settings. The privacy outcome depends on three things they never chose: the host's defaults, the host's patch level, and whether they habitually click Allow.

The good news is that Roundcube's own code takes the private position on both read receipts and images. The project's GitHub repository makes every default auditable, which is more than most webmail can say. Spend two minutes on Displaying Messages, and Roundcube becomes one of the harder inboxes to track.

The Quick Answer

Does Roundcube send read receipts? Only if you click send in the prompt or switch on automatic receipts; the stock mdn_requests default is ask the user. Does Roundcube track you? We found no evidence that it does. It blocks remote images until you allow them, but it has no image proxy and does not clean tracked links. Your host may have loosened the defaults, and an unpatched server may have holes in the blocker, so check your settings page and your version.