Is SparkPost Tracking Your Email? How to Block It

You hover over a button in a marketing email and the status bar shows spgo.io. Five letters, an unfamiliar top level domain, no brand anywhere in it. Everything about that string reads like a link you were trained not to click. It is not malicious. It is SparkPost email tracking, and it is doing exactly what it looks like it is doing: routing you through somebody else's server so your click gets logged before you arrive.

Key Takeaways

• spgo.io is the default tracking domain on every SparkPost account, with eu.spgo.io serving European accounts.
• SparkPost's Tracking Domains API documentation states that tracking domains "wrap the open pixel and all links in your emails" — both mechanisms run through the same domain.
• A wrapped click link appears in the message as something like http://spgo.io/e/[id], reports the click to SparkPost, then forwards you to the real destination.
• The open pixel is a 1 pixel transparent GIF inserted into the message and fetched from SparkPost's servers whenever your client loads images.
• Senders can point a branded subdomain at SparkPost with a CNAME record, after which tracking runs identically but the word spgo never appears in your inbox.

What Is spgo.io and Why Is It in My Email?

spgo.io is the domain SparkPost uses by default to record opens and clicks on behalf of the companies that send through it.

SparkPost is a high volume email delivery platform, in the same category as SendGrid, Amazon SES and Mailgun. Companies do not send mail from it because they love its analytics; they send from it because delivering millions of messages reliably is hard. The engagement tracking arrives bundled.

The API documentation is unusually blunt about what the tracking domain covers. It is not one feature or the other. A tracking domain wraps the open pixel and all links, which means a single unfamiliar domain in your inbox is evidence of two separate tracking mechanisms operating on the same message.

If a sender never configures anything, spgo.io is what you see. That is why the domain shows up in mail from companies that have no visible connection to each other.

Is SparkPost the Same Thing as Bird?

Yes, and the naming is the reason searching for spgo.io leads nowhere helpful.

MessageBird acquired SparkPost in 2021 and later consolidated its products under the Bird brand, with SparkPost becoming Bird Email. The old documentation domains still exist but now redirect: request a page on support.sparkpost.com and you land on bird.com. Existing customers kept the same service and, importantly for you, the same tracking domain.

So a recipient investigating spgo.io in 2026 is chasing a domain owned by a product that has been renamed twice, documented across two websites, and branded as neither. That opacity is not deliberate, but it has the same effect as if it were: the domain in your inbox tells you almost nothing about who is behind it.

How Does SparkPost Track Opens?

With a 1 pixel transparent GIF, the same technique the entire industry uses.

SparkPost inserts the invisible image into outgoing messages. When your mail client has images enabled, it reaches that image tag while rendering, and requests the file from the tracking domain. That request carries your IP address and your user agent string, and the URL itself carries an identifier tying the fetch to your specific copy of the message.

SparkPost maintains a dedicated documentation page on where the open pixel sits inside the message, which tells you something on its own: placement is a tuning decision, because it changes which clients fire the request and when.

Worth noting on the accuracy side, Bird's current metrics documentation acknowledges that privacy proxies automatically open images and states that prefetched opens are excluded from its open rate. That is an admission with two edges. It concedes that open tracking has become unreliable as a measure of human attention, and it confirms that the platform is classifying the fetch, deciding whether a proxy or a person made it.

What Does a spgo.io Link Actually Do?

It logs the click, then redirects you. SparkPost's own materials describe the wrapped form as something like http://spgo.io/e/[id], where the identifier encodes which link, in which message, sent to which recipient.

Click tracking is a materially bigger disclosure than open tracking, and the difference is worth being precise about. An open says the message was rendered. A click says you made a decision. Which of five products you looked at, whether you went to the pricing page or the careers page, whether you read the terms link before the buy link. Repeated across a campaign, that is an interest profile rather than a delivery receipt.

It also survives every defence aimed at images. Turning off image loading does nothing to a rewritten link. The mechanics are the same across every platform that does this, and we have covered them in detail in our explainer on how email link wrapping rewrites URLs to track you.

Why Does a Wrapped Link Look Like Phishing?

Because structurally it is the same thing, minus the intent.

Every piece of security guidance ever written tells you to hover a link and check that the domain matches the sender. Link wrapping breaks that rule as a matter of design. The domain never matches. Users are asked to distinguish "unfamiliar short domain that redirects, operated by a legitimate email platform" from "unfamiliar short domain that redirects, operated by an attacker" using nothing but the string itself, which is not a distinction anyone can reliably make.

The practical consequence is that widespread link wrapping trains people out of the single habit that catches most phishing. It is a real cost, paid by recipients, in exchange for a click through rate figure on somebody's dashboard.

A spgo.io link in your inbox is very probably benign. The problem is that you cannot verify that from the link, which is exactly the property attackers exploit.

Can Senders Hide That They Use SparkPost?

Easily, and many do. This is the limitation of any defence built on recognising one domain name.

SparkPost supports custom tracking domains. A sender adds a CNAME record pointing a subdomain such as click.example.com at SparkPost's infrastructure, verifies it through the API, and from then on both the pixel and the rewritten links carry their own brand. The documentation notes the CNAME target varies by region and service tier, using values such as v2.spgo.io for the US and eu.v2.spgo.io for the EU, and that verification confirms the redirect works and the SSL certificate is valid.

Accounts can run multiple tracking domains at once, selected per sending domain or per subaccount. Nothing about the tracking changes. The data still flows to SparkPost. Only the string you would have recognised disappears.

Be clear about what that means for blockers, including ours. A blocklist matching spgo.io catches default configurations and misses branded ones. That is true of every tracking blocker and every sending platform. An IEEE study of 44,000 emails found pixel blockers are evaded more easily than most users assume. Domain matching is a strong filter, not a guarantee, and anyone promising total coverage is overselling.

How Do You Block SparkPost Tracking in Gmail?

Four options. Only two of them touch click tracking, which is the part that matters most here.

Turn off automatic image loading. In Gmail, go to Settings, See all settings, and under Images pick "Ask before displaying external images". The open pixel stops firing until you approve images for that message. Every real image breaks as well, and every wrapped link still works exactly as before.

Apple Mail Privacy Protection. MPP routes image fetches through Apple's relays and masks your IP address, which is precisely the prefetch behaviour Bird's documentation says it filters out. It prefetches whether you opened the message or not, it does nothing about links, and it does not apply when you read Gmail in a browser.

Unwrap links by hand. Right click a tracked link, copy the address and inspect it before following it. Reasonable for one suspicious message. Unworkable as a routine.

Use a blocker extension. Ugly Email marks tracked messages with an eye icon in the inbox list. PixelBlock blocks open pixels but leaves rewritten links intact, which is a significant gap for a platform like this one. Trocker works across several webmail providers. Our comparison of Ugly Email, PixelBlock and Trocker sets out where each stops.

Gblock sits in the same category, with two differences that matter for SparkPost specifically: it strips tracking links so the spgo.io redirect never fires rather than only blocking the pixel, and it maintains an auto updating blocklist so newly identified tracking domains get covered without you doing anything. It runs inside Gmail, so nothing about how you read mail changes. If you want the wider view first, our guide to blocking email tracking in Gmail compares the whole field.

Is Open Tracking Legal Without Consent?

In Europe, increasingly not. In the United States, it is being litigated.

The EDPB's Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive concluded that a tracking pixel directs the recipient's device to contact a remote server, which puts it inside the consent requirement regardless of whether you subscribed. National regulators have built on that, and our coverage of the CNIL email pixel recommendation and its compliance deadline is the clearest example of a regulator putting a date on it.

In the United States there is no federal equivalent, but plaintiffs have been arguing that an unconsented pixel is an interception under state wiretap law. Our tracker on the CIPA email pixel lawsuit wave follows where courts have come down.

Nothing there is settled enough to protect your inbox this week. Until it is, the reliable move is the unglamorous one: check the source, block what you can, and remember that an unfamiliar redirect domain in your mail is a measurement device, not a delivery detail. If you want to see which trackers are already in your inbox, start with our walkthrough on detecting tracking pixels in Gmail.