What are propagation attacks in email?

Senders embed tokens in Message-IDs; replies propagate them back, letting trackers link responses to recipients — even through relays.

Does blocking images stop all email tracking?

Nope. CSS stylesheets, HTML attributes like table background, and custom properties sneak past, firing network requests on load.

How to fix email reply tracking?

Hash sender Message-IDs in References/In-Reply-To headers before sending replies. Use consistent, irreversible hashes in your domain.

🔒 Security & Privacy

Email Trackers' Sneaky Evolution: CSS Magic, Reply Spies, and Real Traffic Shocker

Thought blocking images killed email tracking? Think again. Real production traffic reveals CSS wizardry, ancient HTML fetches, and reply chains that follow you everywhere.

theAIcatchup Apr 10, 2026 4 min read

Sneaky CSS code and email headers revealing hidden tracking pixels and tokens

⚡ Key Takeaways

CSS techniques like custom properties and @import evade image blockers entirely. 𝕏
Legacy HTML attributes trigger fetches outside CSS, found in real emails. 𝕏
Reply propagation via Message-ID links responses back; hashing neutralizes it without breaking threads. 𝕏

Published by

theAIcatchup

Community-driven. Code-first.

#CSS tracking #email privacy #email relays #email security #email tracking #privacy attacks #privacy evasion #reply headers #reply propagation

Worth sharing?

Get the best Open Source stories of the week in your inbox — no noise, no spam.

Originally reported by Dev.to

⚡ Key Takeaways

The 60-Second TL;DR

theAIcatchup

Share this article

Worth sharing?

Related Stories

React Server Components' Perfect-Score RCE Flaw Exposes Millions of Apps

Anthropic's One-Line Fumble Leaks Billions in Code

Proving Presence with Crypto: A Flutter App That Locks Down Judicial Proofs

GRIDS: Air-Gapped Signing That Ditches Accounts and Passwords Entirely

Stay in the loop