Machine clicks leave clues in the MX record

Question: which recipient domains might produce machine clicks?

Here is a rule many senders use. If opens and clicks arrive within seconds of delivery, a machine probably produced them. A security product inspected the message, and the sending platform recorded the interaction as engagement.

Timing is useful evidence. But it cannot tell you which product acted. It cannot tell you whether another product also inspected the message. And it cannot tell you which domains to expect similar activity from next time.

It can also mislead in both directions. A recipient with a push notification can click within seconds. Automated analysis can continue after delivery, outside a short detection window.

Part of the answer is visible before you send.

An MX record identifies the infrastructure that receives a domain's inbound mail. That infrastructure may identify a mailbox platform or security gateway. If so, it can point to products with documented URL inspection capabilities.

Some products check a URL against reputation data. Others retrieve the destination, or analyze it in a browser or sandbox.

Reputation checking alone does not create a machine click. A request to a tracking URL can.

Whether that request becomes a recorded click depends on two things. One is what the security product requests. The other is how the sending platform counts it.

What vendors document

Our accompanying CSV reviews 32 product entries, using public vendor documentation. They fall into four groups:

• 8 entries document pre-delivery URL retrieval or deeper analysis capability, subject to configuration and deployment.
• 7 entries document URL retrieval or dynamic analysis. The reviewed evidence does not establish whether it completes before delivery.
• 10 entries document click-time checking without establishing pre-delivery fetching.
• 7 entries lack sufficient evidence to establish the pre-delivery retrieval mechanism.

These are product entries, not counts of distinct vendors or customer deployments. Some entries cover related product families. The list is not a complete market census.

The first group also needs a qualification. Five entries document a pre-delivery capability. Three of them — Barracuda, Microsoft and Sublime — carry explicit configuration or delivery-mode caveats. Mimecast documents pre-delivery deep scanning. Destination retrieval is an inference from that description.

We therefore describe this group as retrieval or deeper analysis. We do not claim that all eight explicitly document pre-delivery HTTP requests.

The click-time group needs equally careful reading. Documentation of checking when a person clicks does not prove that a product never fetches links earlier. It does not justify a "no machine clicks" label.

Scale matters more than the gateway market suggests

Dedicated email security gateways are a small part of the picture.

As of 2026-10-12, Datazag observes the inbound mail path for 115.6 million corporate domains. Microsoft and Google together handle mail for 24% of them. Dedicated gateway products account for 2.3%.

So treating machine clicks as a secure email gateway problem misses most of the infrastructure that can produce them.

These shares count domains. They are not statements about revenue, customer numbers or product quality.

Microsoft needs separate treatment

Microsoft Defender for Office 365 shows the difference between visible infrastructure and invisible policy.

Microsoft documents Safe Links scanning before message delivery and selective URL detonation. It also documents a setting that can hold messages until scanning finishes. Depending on the policy, delivery can also proceed before analysis completes.

A Microsoft MX record does not reveal those settings.

It can identify Microsoft mail infrastructure. It cannot tell you whether Defender for Office 365 is licensed. It cannot tell you whether Safe Links covers the recipient, or which scanning options apply.

Microsoft-hosted domains are therefore a population in which this behavior may occur. They are not a count of domains that definitely generate machine clicks.

Google needs a different classification. The reviewed documentation establishes Gmail click-time protection. It does not establish routine pre-delivery fetching of email-body links. On that evidence, Google hosting should not count as confirmed fetching infrastructure.

Three limits of the MX signal

The MX record identifies infrastructure, not policy. Deeper analysis can depend on entitlement, configuration, exclusions and risk thresholds. Customer-owned gateway names, resellers and upstream services can also hide the underlying product.

URL analysis is often selective. Vendors describe inspecting suspicious, unknown or higher-risk destinations. Scanning every message does not necessarily mean visiting every link. A capability documented for a product does not establish what happened to a particular email.

Some protection is invisible in MX. API and connector integrations can inspect mail without a distinctive public MX record. This is not limited to post-delivery inspection. Sublime, for example, documents optional pre-delivery protection without MX changes. A Microsoft- or Google-hosted domain may therefore have other security products inspecting its links.

Timing adds another piece of evidence

Infrastructure tells you where automated URL interactions are plausible. Timing and behavior help assess individual events.

Some patterns support a machine-interaction classification. Requests cluster around delivery. Several links are visited in quick succession. The same pattern repeats across messages. None is conclusive by itself.

The distinction between pre-delivery and later analysis matters here. Trellix/FireEye documents live website analysis while allowing delivery to proceed. Other products also support asynchronous or post-delivery processing. A timing rule focused only on the first few seconds can miss that activity.

Datazag supplies the infrastructure signal. Senders already hold the engagement signal.

For ESPs, email intelligence under your brand explains how the infrastructure data joins your engagement data.

Joining them gives a stronger basis for judging engagement. A rapid run of requests means more when the recipient's mail infrastructure has documented URL retrieval or deeper analysis.

MX records provide a clue to machine clicks. They do not prove that a click was automated.

The vendor evidence page and its CSV record the evidence we reviewed on 2026-10-01. They include sources, confidence, delivery-timing caveats and our original classifications for comparison.