Is Trello Tracking Your Email? How to Block It

Trello email tracking is a harder question than it looks, because Trello is an Atlassian product that still sends mail under its own domain. Your card and board notifications come from trello.com, not from the atlassian.net addresses we examined for Jira's email tracking. So we started from scratch: read the domain's sending policy, pulled every hostname Trello has ever put in a TLS certificate from certificate transparency, and sent live requests at the one that looked like a tracker. It behaved exactly like one.

Key Takeaways

• The host sptrack.trello.com is served by SparkPost's tracking engine (response header server: msys-et) and answered our test requests byte for byte like spgo.io, SparkPost's default tracking domain.
• SparkPost's own documentation says tracking domains "wrap the open pixel and all links in your emails," so a tracking domain named after Trello exists to measure opens and clicks on Trello mail.
• Trello's SPF record authorises SparkPost through spemail.trello.com, a CNAME to atlassian.mail.e.sparkpost.com, alongside Salesforce Marketing Cloud, Google and Amazon SES.
• We did not capture a real Trello notification, so we cannot prove that open tracking is switched on for everyday card alerts; the honest finding is capability plus live infrastructure, not a confirmed pixel in every message.
• Trello lets you set email notifications to Never, Periodically or Instantly, and cutting the volume is the one fix that works in every mail client.

Does Trello Track When You Open a Notification Email?

Trello has the machinery to track opens under its own domain, but we could not confirm it fires on routine notifications. That distinction matters, so here is the evidence in order.

Start with who is allowed to send as trello.com. The domain's SPF record reads, in full, v=spf1 include:_spf.google.com include:_spf.salesforce.com include:spemail.trello.com include:cust-spf.exacttarget.com include:amazonses.com -all. Five senders, then a hard fail for everyone else:

• SparkPost. spemail.trello.com is a CNAME to atlassian.mail.e.sparkpost.com, the same SparkPost account hostname Atlassian uses for Jira's US mail. This is the transactional pipe.
• Salesforce Marketing Cloud. cust-spf.exacttarget.com is the ExactTarget include, the platform Atlassian runs its marketing on.
• Salesforce, Google Workspace and Amazon SES. CRM mail, staff mail and a general purpose relay.

An SPF record lists who may send. It says nothing about what they put inside the message. For that you need the tracking host.

What Is sptrack.trello.com?

sptrack.trello.com is a SparkPost custom tracking domain: the address Trello's links and open pixel would point at when engagement tracking is on. The name alone would prove nothing, so we tested it against controls.

First, the wildcard check. A made up name, zzq7nope99.trello.com, returns no DNS answer at all, so trello.com does not resolve everything the way atlassian.net does. sptrack.trello.com was created on purpose. It resolves to Amazon CloudFront, and every response carries the header server: msys-et, Message Systems' engagement tracker, the engine SparkPost is built on.

Second, the behaviour check. Two short token paths shaped like SparkPost's wrapped links came back as a 147 byte 404 with charset=utf-8 and a locked down content security policy. A nonsense path returned a different 150 byte 404 without either. The server recognises the route and rejects our fake token, instead of treating it as noise. Then the reference: we sent the same three requests to spgo.io, which SparkPost's API documentation names as its default tracking domain. Same sizes, same header, 147, 147 and 150 bytes. Trello's host is a SparkPost tracker wearing Trello's name.

What it is for is not a matter of interpretation. SparkPost's documentation says tracking domains "are used in engagement tracking to report email opens and link clicks. They wrap the open pixel and all links in your emails," and that a clicked link reports the event "then quickly forward[s] to the intended destination." Our wider breakdown of SparkPost tracking covers the vendor side.

Why "Partly" Is the Honest Answer

Because tracking in SparkPost is a per message switch, and a live tracking domain only proves the switch exists. A sender can enable open tracking for its weekly digest and leave it off for password resets, all through the same host. Without the raw source of a real Trello notification, we cannot tell you which Trello emails carry the pixel.

Here is the inference we are willing to make. Nobody provisions a branded tracking domain, puts it behind a CDN and keeps its certificate current for a feature they never use. Trello uses sptrack.trello.com for something. Whether that something is your card alerts or only Trello's onboarding and product mail is what the next step settles, and you can run it yourself in thirty seconds.

Atlassian's Cookies and Tracking Notice covers the policy side. It says Atlassian and its partners "collect information using web beacons (also known as 'tracking pixels')," used "to determine whether an email has been opened and acted upon." The notice speaks of Atlassian's services generally and does not itemise Trello, so we read it as permission Trello has, not proof of what Trello does.

How Do You Check a Trello Email Yourself?

Open the message in Gmail, choose Show original from the three dot menu, and search the raw source for sptrack.trello.com. Our guide on how to tell if an email is being tracked walks through the same view.

• Hits inside <img> tags mean an open pixel. Search the hostname rather than width=1; tiny image sizes vary.
• Hits inside href links mean click tracking: each button routes through Trello's tracker before reaching the card.
• No hits means that message links straight to trello.com and carries no SparkPost beacon.

Compare a card notification against a Trello marketing or onboarding email. If only the second one lights up, you have reproduced the same split we found at Jira, where ticket mail looked clean and marketing mail carried the pixel.

Why Email Users Should Care

A Trello open is a work signal. The pixel request carries a timestamp, your IP address and the approximate location behind it, and a user agent naming your mail app and device. Multiply that by a busy board and the record starts to look like a map of when you work and where from. Our explainer on open tracking versus click tracking goes deeper on what each signal reveals.

Here is the comparison that should change how you audit your inbox. At Jira we found no tracking host on the notification domain at all. At Trello, owned by the same company and sending through the same SparkPost account, the notification domain has one. Corporate ownership tells you nothing; each domain has to be checked on its own. Gmail's image proxy does not help either: the proxy still fetches the image, so the open is still recorded, just from Google's address instead of yours.

How Do You Block Trello Email Tracking in Gmail?

Cut the volume first, then block the pixel and the redirect. Trello's notification settings offer three frequencies: Never ("You won't get email notifications for activity in Trello"), Periodically ("an hourly summary"), and Instantly. Switching to Periodically turns dozens of alerts into a handful of digests; Never removes the channel entirely if you live in the app anyway.

For mail you keep, the options compared honestly:

• Gmail's image setting. Settings, General, Ask before displaying external images. Free and thorough, but it breaks every image, and it does nothing about tracked links.
• Apple Mail Privacy Protection. Apple's feature hides your IP and open time from senders, but only for mail read in Apple Mail.
• Ugly Email. Open source, flags known trackers with an eye icon. The list is curated by hand, so a branded host like sptrack.trello.com may take a while to appear.
• PixelBlock. Blocks pixel requests in Gmail and shows a red eye. Leaves tracked links alone.
• Trocker. Flags pixels and warns about tracked links, across several webmail clients.
• Proton Mail or HEY. Both block spy pixels by default. The price is moving your mail off Gmail, rarely possible for a work account.
• Gblock. Stays inside Gmail, blocks the pixel, and strips tracking redirects from links, with a blocklist that updates automatically as new branded hosts turn up.

The full side by side lives in how to block email tracking in Gmail, and the tools built for the other side, the senders, are catalogued in email tracker Chrome extensions.

What We Could Not Verify

Three gaps, stated plainly. We did not dissect a live Trello notification, so which messages carry the beacon is unproven. We could not trigger a real pixel on sptrack.trello.com, because that needs a valid signed token only a real email contains; our evidence is the server's recognisable rejection, matched against SparkPost's own default domain. And a second certificate name, mgo.trello.com, no longer resolves in DNS, so we draw no conclusion from it.