Is Salesforce Marketing Cloud Tracking Your Email? Block exct.net

Salesforce Marketing Cloud email tracking is not a setting a marketer switches on for your message. It is the default shape of the send. Salesforce inserts a 1x1 transparent GIF into the email, rewrites every link so the click passes through a redirect first, and files both events against your subscriber record with a timestamp. The redirect host is usually a subdomain of exct.net, short for ExactTarget, the company Salesforce bought in 2013 and renamed. Everything below comes from Salesforce's own documentation and from DNS and whois lookups run on 19 August 2026.

Key Takeaways

• Salesforce describes its open tracking pixel as "a tiny, usually invisible image not directly embedded in the body of the email but hosted on a remote server" that reports "whether, when and how the email was opened".
• Click tracking rewrites links through Salesforce infrastructure, typically a host in the form cl.s13.exct.net, where the number identifies the Marketing Cloud stack the sender's account lives on.
• The domain exct.net was created on 24 September 2004 through MarkMonitor and its whois registrant organization today reads Salesforce, Inc.
• The _Click data view stores SubscriberKey, EventDate, Domain, URL, LinkName and LinkContent, so a click is a row naming you, the second, and the exact link.
• Einstein Engagement Scoring is built on that same event stream and analyzes up to 90 days of a subscriber's open, click and unsubscribe history to predict future behaviour.

What Is Salesforce Marketing Cloud Email Tracking?

It is two separate mechanisms bolted onto the same send: an image request that records the open, and a redirect that records the click.

Salesforce is unusually direct about the first one. Its help article on tracking pixels in marketing email communications defines the pixel as "a tiny, usually invisible image not directly embedded in the body of the email but hosted on a remote server", collecting "information such as whether, when and how the email was opened". The same page says an administrator can disable open tracking at the send level, which is another way of saying the decision belongs to the sender.

The second mechanism is link wrapping. Before the message leaves, Marketing Cloud replaces the destination of each link with a redirect URL carrying an encoded token. You click, Salesforce logs the event, then it forwards you to where you meant to go. The delay is a few dozen milliseconds, which is why almost nobody notices. Account Engagement, the product formerly called Pardot, works on a parallel system and we cover it separately in our guide to Pardot email tracking.

What Is exct.net, and Which Subdomains Should You Look For?

exct.net is Salesforce's tracking and redirect domain, inherited from ExactTarget, and the subdomain in front of it tells you which server stack the sender sits on.

A whois lookup on 19 August 2026 shows exct.net created on 24 September 2004 through MarkMonitor, with the registrant organization listed as Salesforce, Inc. That is not a burner domain bought to hide a tracker. It predates the acquisition and it is registered in the open.

The pattern you will actually see in a message source is a click host built from the letters cl, a stack identifier and the apex: cl.s7.exct.net, cl.s13.exct.net, and so on. On the date of writing, cl.s7.exct.net resolves through akamai-san24.exacttarget.com.edgekey.net onto Akamai, while cl.s13.exct.net answers directly on 96.43.154.9. Different stacks, different delivery paths, one company. Be careful with the variants floating around forum posts. Older writeups quote a cl.s6.exct.net/?qs= shape for wrapped links, and hosts such as click.s7.exct.net and mc.s7.exct.net returned no DNS answer when we checked, so treat any subdomain list as a starting point rather than a complete map. Salesforce publishes the definitive per account values inside Marketing Cloud domain settings, not in a public list.

This is the part that matters for anyone writing a blocklist by hand. Senders can replace the shared domain with a branded one of their own, pointed at Salesforce by a CNAME record, alongside separate domains for CloudPages landing pages and SMS short links. A large brand doing that produces click links on something like links.brandname.com, which looks like first party infrastructure and is not. One domain rule for exct.net catches the default. It catches none of the branded ones.

What Does an Open Actually Record?

A row naming you, the moment you looked, and, if the sender has the right extract enabled, the browser, operating system, email client and device you looked with.

Marketing Cloud stores engagement in system data views the sender can query with SQL. The _Open view records a separate row every time the pixel fires, so opening the same newsletter three times on Tuesday produces three EventDate values, not one. The _Click view is richer: it carries SubscriberKey, EventDate, Domain, URL, LinkName, LinkContent and an IsUnique flag. Which link, in which email, at which second, by which person.

Device level detail lives one layer further out, in tracking extracts, which include Browser, EmailClient, OperatingSystem and Device fields for opens. Those are not on by default and have to be enabled for the account by Salesforce support, which is a real limit worth stating plainly rather than a fig leaf. Geolocation is the same story: the pixel request carries your IP address to the server that answers it, and IP to city lookup is a routine step afterwards, but Marketing Cloud does not hand every marketer a map by default. Then there is impression tracking, an extra pixel per content region that reports which dynamic block you were shown, so the sender learns not just that you opened but which version of the email you got.

Why Does Einstein Make the Open Worth More Than a Number?

Because your opens and clicks are training data, not just a report line.

The Einstein Engagement Scoring model card states that the model uses each subscriber's history of sends, bounces, opens, clicks, unsubscribes and the timestamps attached to them, analyzing up to 90 days of it, to predict how likely you are to open and to click in the next seven days, and how likely you are to leave the list altogether.

Follow that chain to its end and the picture changes. Every pixel fetch nudges a per person score which decides what you are sent next, how often, and whether you get put in a win back flow. Salesforce even acknowledges that email client privacy changes have made opens a less reliable signal, and says Einstein now leans more on engagement and unsubscribe rates than on open rate alone. That is a candid admission that the metric is noisy, and the collection continues anyway. Most coverage of email tracking stops at the open rate report. The scoring layer is the reason the data outlives the campaign.

How Do You Check a Message Yourself?

Open the raw source in Gmail and search it, which takes about fifteen seconds and needs no tooling.

• In Gmail on desktop, open the message, click the three dot menu at the top right of the message and choose "Show original".
• Search that page for exct.net. Hits on cl.s hosts inside href attributes are wrapped links.
• Search for <img tags near the closing </body>. An image with width and height of 1, or a long opaque query string and no visible content, is the open pixel.
• If the links point at a subdomain of the brand you recognise, resolve it. A CNAME landing on Salesforce infrastructure means branded link wrapping rather than a first party link.
• Our walkthrough on detecting email tracking pixels in Gmail covers the same checks for other platforms.

How Do You Block Salesforce Marketing Cloud Tracking in Gmail?

Stop the image request and stop using the rewritten link, in that order, because they are two different events.

• Turn off automatic image loading. Gmail Settings, General, then "Ask before displaying external images", documented on Google's image settings help page. Salesforce records no open when the pixel never loads. The cost is that no images load at all, and clicks are untouched.
• Block the tracker, not the message. An extension that removes tracking pixels inside Gmail leaves the legitimate images in place. Gblock does this before the request leaves your browser.
• Do not follow the wrapped link. A click on a cl.s13.exct.net URL is logged with the link name and your subscriber key before you see the destination. Copy the final URL, or let Gblock strip the redirect so you land directly.
• Use the unsubscribe link when you mean it. Unsubscribes, bounces and spam complaints are recorded server side. No blocker on earth touches those, and pretending otherwise would be dishonest.
• Assume branded domains exist. If a sender wrapped its links on its own subdomain, a rule written for exct.net misses it, which is exactly the case for an automatically maintained blocklist over a hand written one.

How Does Gblock Compare to Ugly Email, PixelBlock and Trocker?

All of them block pixels. The differences are coverage of tracked links, how the blocklist is maintained, and whether you have to leave Gmail, and we lay them out side by side in our roundup of the best email tracker blocker extensions.

Ugly Email is MIT licensed, flags tracked Gmail messages with an eye icon and blocks the pixel locally. Trocker is free and open source, works across several webmail providers, and marks tracked links as well as pixels. PixelBlock does straightforward pixel blocking, though its Manifest V2 lineage means you should check you have a maintained build. Proton Mail and HEY handle protection inside their own clients, which is genuinely strong and also irrelevant if your mail stays in Gmail.

Gblock's claim is narrow and specific rather than "better". It stays inside Gmail, it strips tracking links as well as pixels, and its blocklist updates itself, which matters most against a platform like Marketing Cloud where senders can move their tracking onto a branded domain you have never seen. Our earlier piece on Salesforce email tracking across the product line covers the wider picture.

The Honest Summary

Salesforce is not hiding this. It defines the pixel in its own help pages, documents the data views, publishes a model card explaining what Einstein learns from your behaviour, and registers its tracking domain under its own name. Compared with vendors that route opens through a host registered behind a privacy service, that is a higher standard.

It is also all pointed at a person who never agreed to any of it. The pixel goes into the send by default, the links are rewritten before you receive them, the open lands in _Open with your subscriber key attached, and a 90 day rolling model turns the pattern into a prediction about you. The one part of that chain sitting on your side of the wire is the image request your mail client makes. Refusing it is the whole of your leverage, and it works. Our guide to Mailchimp open tracking shows the same fetch, the same refusal, a different logo.