# Open and click tracking

Both are off by default, both are per domain, and both need one extra DNS record. Turn them on when you want the numbers, and read what an open actually means before you do.

## The record

Tracking links are served from a hostname of your own — `links.send.acme.example` for a domain sending as `send.acme.example` — so a reader sees your domain rather than ours. That takes one `CNAME`, published at the `links` label on your sending domain and pointing at `links1.rasket-dns.com`. It comes back in the domain's `records` array as the `Tracking` row, alongside the DKIM and return-path records.

- The record is optional. Tracking works without it: until your hostname is ready, links and the pixel use our tracking address instead, and switch to yours once it verifies.
- It is verified when the `CNAME` resolves *and* a certificate has been issued for the hostname, which is why it can sit at `pending` for a few minutes after the DNS is right.
- If your provider proxies records — Cloudflare's orange cloud — leave this one unproxied. A proxy terminates TLS with its own certificate and the hostname stops working.

> No CAA record is needed, from you or from us. A name holding a `CNAME` may hold nothing else, and certificate authorities follow the alias rather than climbing to your apex — so your domain's CAA policy never governs this hostname.

## Turning it on

Set either flag on `POST /domains` or `PATCH /domains/{domain_id}`. They take effect on the next email you send. Until the `Tracking` record is verified, links use our tracking address; after that, your own hostname.

| Field | Does |
| --- | --- |
| `open_tracking` | Inserts a 1×1 image before the closing body tag. Loading it records an open. |
| `click_tracking` | Rewrites every `http` and `https` link in the HTML body to a link on your tracking hostname, which redirects. |
| `tracking_subdomain` | The label the tracking hostname uses. Defaults to `links`. Changing it publishes a new record and re-verifies. |

Rewriting happens when the message is assembled, and it is the one place a send changes your HTML. The plain-text part is never touched, and neither is a `mailto:` link, a `tel:` link, a fragment-only link, or any anchor carrying `data-rasket-no-track`.

## What an open really is

Open tracking works by loading a tiny image. Some mail clients and image proxies load images on the reader's behalf, so opens can be recorded when no one has read the email, or missed when images are blocked. Treat open rates as a trend, not a count.

We record the user agent exactly as it arrives, proxy and all — a Google image proxy shows as `… (via ggpht.com GoogleImageProxy)` in the `open.userAgent` field of the [`email.opened` event](https://www.rasket.com/docs/events). It is never rewritten, hidden, or filtered out, so you can decide for yourself which opens to count.

- An open is recorded at most once per email per minute, and at most 100 times.
- Clicks are capped at 500 per email.
- Past either cap the pixel and the redirect still work — the reader notices nothing; only the recording stops.
- Neither event identifies which recipient acted when a message had several. There is no `recipient` field on an open or a click.

## Where a click goes

A click redirects only to the URL stored for that link when the message was assembled. There is no `url` parameter on the tracking link and nothing in the request can change the destination, so a tracked link cannot be turned into an open redirect against your domain. A link whose token we do not recognise is a `404` with no body.