Remote Images in Emails: Why Blocking Them by Default Matters

Here’s something most people never think about: when you open an email, you might not be the only one who knows you opened it.

The sender often knows too. Not because they’re watching your screen, but because your email client quietly fetched a picture from their server the moment you clicked.

The short answer: remote images are pictures that load from the sender’s server when you open an email. Every one of those requests can reveal when you opened the email, your approximate location via your IP address, which app you use, and that your address is active. Blocking remote images by default stops that until you decide to load them.

That’s the whole idea. The rest of this article is about why it matters more than it sounds, what image proxies do (and don’t do), and how to turn blocking on in the email client you already use.

What are remote images in emails?

An image can get into an email in two ways.

It can be embedded: the image file travels inside the message, as an attachment that the HTML references (usually via a cid: link). Once the email is in your inbox, the image is too. Opening it doesn’t contact anyone.

Or it can be remote: the email only contains a link, something like

<img src="https://images.example-newsletter.com/header.png">

and your email client downloads the image from that server when you open the message. Almost every newsletter, marketing email and transactional email works this way, because it keeps messages small and lets senders swap images after sending.

And it’s not only images. Remote stylesheets, web fonts and CSS background images all trigger the same kind of request. That’s why some clients call the setting “remote content” instead of “remote images.” Same problem, broader name.

What happens when your email client loads a remote image?

It makes an ordinary HTTP request to the sender’s server (or to whoever hosts the image). Just like a browser loading a web page.

That request includes, among other things:

• your IP address
• the exact time of the request
• a user agent string that often hints at your email app and operating system
• the full URL of the image

The last point is the important one. The URL doesn’t have to be the same for everyone. A sender can generate a unique image link for every single recipient, like header.png?r=8f3a91c2. Now the server doesn’t just know someone opened the email. It knows you did.

What can a sender learn from remote images?

More than most people expect. From a single image request, a sender can usually work out:

• That you opened the email. And when. And how often, if the image loads again each time you open it.
• Your approximate location. An IP address usually maps to a city or region, sometimes to a company network.
• Your device and app. The user agent and request behavior often give that away.
• That your address is real and active. This is the part spammers care about. A confirmed address is worth more than a guessed one.

Mozilla’s own Thunderbird documentation lists pretty much exactly these points as the reason Thunderbird blocks remote content by default.

You’ve probably heard of tracking pixels: tiny, invisible 1×1 images whose only job is to report an open. I’ve written about those in detail in how tracking pixels in emails work. But here’s the thing: you don’t need an invisible pixel to track someone. The big header image of a newsletter can do the same job, as long as its URL is unique per recipient. Every remote image is a potential tracker. That’s why blocking only “known tracking pixels” isn’t the same as blocking remote images.

Are remote images in emails a security risk?

Mostly they’re a privacy problem. But not only.

The best-known example is EFAIL, published in 2018. Researchers showed that attackers could manipulate encrypted OpenPGP and S/MIME messages so that, after decryption, the email client would load an external resource and send the decrypted plaintext along in the URL. The remote content request was the exfiltration channel. One of the main recommended mitigations at the time: turn off loading of remote content in your email client.

There’s also a more everyday risk. Confirming to a spammer that your address is live tends to bring you more spam, including more phishing. And every remote request means your client is talking to a server you never chose to contact, one that may not be particularly careful about what it serves.

None of this means opening an email is dangerous in itself. It means loading remote content is an action with consequences, and it should be your decision.

Do image proxies solve the problem?

Partly. They’re a real improvement, but they don’t do what a lot of people assume they do.

Gmail has routed images through its own proxy servers since December 2013. The sender’s server sees a request from Google, not from you, so your IP address and location stay hidden. But Gmail still fetches the image when you open the email. So the sender still learns that you opened it and roughly when, especially if the image URL is unique to you.

Apple Mail Privacy Protection, introduced with iOS 15 and macOS Monterey, goes further. It downloads remote content in the background whether you open the email or not, and routes it through multiple proxy servers that hide your IP address. Because everything gets fetched anyway, open tracking becomes unreliable. That’s clever. But it’s opt-in, it only works in Apple’s own Mail app, and it still means your mail provider’s infrastructure fetches content from every sender on your behalf.

Outlook.com offers a similar setting that loads external images through the Outlook service.

So proxies hide who and where. They mostly don’t hide whether and when. Only not loading the content does that.

How do Gmail, Outlook, Apple Mail and Thunderbird handle remote images?

Defaults vary a lot. Here’s where the big ones stand, based on their own documentation:

Email client	Default behavior	Privacy option
Gmail	Loads external images automatically, via Google’s image proxy. Suspicious senders are an exception.	“Ask before displaying external images”
Apple Mail	Loads remote content automatically.	Mail Privacy Protection (“Protect Mail Activity”) or blocking all remote content
Outlook (classic, Windows)	Doesn’t download pictures automatically, except from Safe Senders.	Trust Center setting for automatic downloads
Outlook.com / new Outlook	Loads external images, with an option to route them through the Outlook service.	Image proxy setting under Privacy and data
Thunderbird	Blocks remote content by default and shows a notification bar.	Allow per message or per sender

Notice the pattern. The two clients that block by default are the old-school desktop ones. The big webmail services load everything and try to soften the impact with proxies.

Why should blocking remote images be the default?

Because defaults decide what actually happens.

Almost nobody digs through their email settings. Whatever the client does out of the box is what it does for the vast majority of its users, forever. If remote images load by default, most people are tracked by default, and most of them never find out.

There’s a simple principle behind blocking by default: opening an email is not the same as agreeing to tell the sender you’ve read it. You open an email to read it. That’s all. If you want the pretty header image, you can load it with one click. If you don’t, nobody learns anything.

Regulators seem to see it similarly. In its Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive (final version adopted in October 2024), the European Data Protection Board explicitly discusses tracking pixels in emails and concludes that the ePrivacy rules on accessing users’ devices apply to them. That’s a question for senders and their lawyers. But it tells you this isn’t a niche worry of privacy nerds.

And honestly, I think the “it’s just a picture” framing has made people far too relaxed about this. It’s not just a picture. It’s a network request that you didn’t decide to make.

What are the downsides of blocking images in emails?

Let’s be fair here. There are some.

• Newsletters look broken. Empty boxes, missing logos, sometimes an email that’s basically one big image and nothing else.
• It’s one more click. For emails you actually want to see properly.
• Some content only works with images. Charts, product photos, QR codes in tickets.

The usual fix is a per-sender exception: allow remote content from the newsletters you trust, block everyone else. One caveat, which Mozilla also points out: sender addresses can be spoofed. An exception for a sender is a little less safe than it looks, because someone could pretend to be that sender.

Still, a few extra clicks a week is a pretty small price for not being tracked by every email you open.

How do I block remote images in my email client?

Menu names change from version to version, so treat these as a guide rather than gospel.

How to block images in Gmail

Open Gmail on the web, click the gear icon, then See all settings. On the General tab, find Images, choose Ask before displaying external images and click Save Changes at the bottom. To see images in a specific email later, click Display images below.

How to block images in Apple Mail

On a Mac, open Mail > Settings > Privacy. On iPhone and iPad, go to Settings > Mail > Privacy Protection (in newer iOS versions this may sit under Settings > Apps > Mail). You can either turn on Protect Mail Activity or turn it off and enable Block All Remote Content instead. Protect Mail Activity hides your IP and preloads content. Block All Remote Content simply doesn’t load it.

How to block images in Outlook

In classic Outlook for Windows, go to File > Options > Trust Center > Trust Center Settings > Automatic Download and make sure Don’t download pictures automatically in standard HTML email messages or RSS items is checked. It usually is by default. In Outlook.com, look under Settings > Mail > Privacy and data for the external image setting and make sure images are loaded through the Outlook service.

How to block images in Thunderbird

Nothing to do. Thunderbird blocks remote content by default. When an email contains it, you’ll see a bar at the top of the message with options to load it for that message or always allow it for that sender.

How should senders design emails that work with images blocked?

If you send newsletters yourself, assume a good part of your audience will see your email without images. Design for that:

• Put the important information in real text, not inside an image.
• Give every image a meaningful alt text.
• Don’t build the whole email as one big image. It looks broken when blocked and tends to hurt deliverability too.
• Make your buttons and links HTML, not images of buttons.
• Don’t rely on open rates. Between blocked images, image proxies and Apple’s preloading, they’ve become a pretty weak signal anyway. Clicks and replies tell you more.

An email that works without images is also an email that works for screen reader users. Win-win.

This is also how YouniqMail handles it: remote content stays blocked until you load it, and you can allow trusted senders with one click.

Frequently asked questions

Is it safe to open an email that contains images?

Opening an email with images is generally not dangerous in itself, but loading remote images lets the sender see that you opened it, when, and roughly where you are. If your email client blocks remote images, you can open the email and read the text without the sender learning anything.

Does blocking images stop all email tracking?

No. Blocking remote content stops open tracking, but links in emails can still be tracked when you click them, because they usually go through the sender’s tracking server first. Blocking images removes the tracking that happens without any action from you.

Does Gmail’s image proxy protect my privacy?

Partly. Gmail’s proxy hides your IP address and location from the sender, but it still loads images when you open an email. The sender can still see that the email was opened and roughly when.

What is the difference between embedded and remote images in emails?

Embedded images are included inside the email itself, so opening the message doesn’t contact any server. Remote images are only linked in the email and are downloaded from the sender’s server when you open it, which is what makes tracking possible.

Why do some emails show images automatically and others don’t?

It depends on your email client’s settings and on the sender. Many clients load images from trusted or known senders automatically, while blocking them for unknown or suspicious senders. Gmail, for example, asks before showing images from senders it considers suspicious, even if you’ve set it to always display images.