A B2B email does not travel to a person. It travels through a hosting duopoly, a security gateway, and a client, and every one of those layers now either fabricates engagement events, suppresses them, or strips the data that made them mean something. The result is not noisy data. It is data whose error runs in two directions at once, is largest at your biggest accounts, and does not stay inside the report.
Your click rate, the metric everyone retreated to when opens broke, is inflated by enterprise security gateways that fetch every link before a human sees the message, and those gateways are concentrated in exactly the large, security-mature organisations you most want to sell to. Your open rate is simultaneously fabricated by clients that fetch on receipt and suppressed by clients that block images by default, in proportions you cannot observe, and the who-where-what-device data underneath it has been fiction since 2013.
Everything below is the mechanism, the evidence, and what is left that still counts.
Start with who runs the mailboxes, because everything else follows from it. When the MX records of the Inc. 5000, the five thousand fastest-growing private companies in the US, were analysed, 41% routed mail to Google Workspace and 35% to Microsoft 365. Three in four of the exact companies a B2B vendor wants to reach, hosted by two providers. In the enterprise segment above that sample, the balance tilts further toward Microsoft, which is why your instinct that B2B means Outlook is right.
Now look at who came third in that same study. Not a mailbox provider. Proofpoint, on 190 domains, followed by Mimecast on 137 and Barracuda on 116. Those are security gateways. Nearly one company in ten points its MX record at a scanner before the mail reaches any mailbox at all, and most of those companies host on Microsoft or Google behind it. The third-largest "email provider" in B2B is the security stack itself.
So the path your campaign actually takes is: your platform → a security gateway that inspects it → a Microsoft or Google mailbox that filters and proxies it → a client that decides what to fetch and when. Four layers. Each one touches your tracking, and each one belongs to someone other than your prospect.
One distinction to hold onto, because most commentary blurs it: the mailbox (where the account lives, Microsoft or Google for three-quarters of B2B) and the client (the app that renders the message, Outlook, a browser tab, or the Mail app on an iPhone) are different layers that break your metrics in different ways. A prospect on Microsoft 365 reading on their iPhone passes through Microsoft's gateway and Apple's privacy relay. The distortions stack.
There is no open event in email. The protocol has no such concept and never did. What exists is a one-pixel image with a unique URL. When something fetches that image, your sending platform logs a request and calls it an open.
So an "open" has only ever meant one thing: something, somewhere, downloaded an image. Every inference beyond that, that a person saw it, that they read it, that they were interested, was always a convention rather than a measurement. It held up while the only thing that fetched images was a human's mail client displaying a message. Each layer of the path above has now stopped that being true, and they stopped at different times.
When opens became unreliable the standard advice was to judge campaigns on clicks, on the reasoning that a click takes deliberate action. In consumer email that reasoning mostly holds. In B2B it collapses, because the gateway layer's entire job is to take that action first.
Microsoft Defender for Office 365 is the clearest documented case, because Microsoft publishes exactly what it does. Safe Links "provides URL scanning and rewriting of inbound email messages during mail flow, and time-of-click verification of URLs". And on timing, from the same documentation: "As long as Safe Links protection is turned on, URLs are scanned prior to message delivery, regardless of whether the URLs are rewritten or not."
Prior to delivery. The link in your email is fetched before the message reaches the mailbox. Microsoft goes further for anything it has not seen before: URLs "that don't have a valid reputation are detonated asynchronously in the background", and an administrator can hold the message entirely until scanning finishes.
Detonation means a machine visits your landing page. Your analytics cannot tell that visit apart from a curious VP of Operations, because at the HTTP level it is the same request. Proofpoint, Mimecast and Barracuda, the companies sitting directly in the MX records above, operate equivalent link-rewriting and scanning services, which is why URLs arriving at your server so often carry safelinks.protection.outlook.com, urldefense.com or protect.mimecast.com in the referring chain.
How much of your click rate is this? The most-cited industry figure is from M3AAWG's 2020 working paper on non-human interactions, which put non-human activity at 20% to 80% of recorded clicks on B2B lists, against roughly 10% for consumer lists. Treat that range with respect and suspicion in equal measure: it is six years old, and it is so wide that it is less a measurement than an admission that the answer depends entirely on how many of your recipients sit behind a gateway, which is exactly the thing you cannot see from the sending side. The audit section below shows how to measure your own rate instead of quoting anyone's.
At the Google mailbox, the metadata died in 2013. Gmail has routed every image in every message through its own proxy servers since December 2013. The fetch your platform logs comes from googleusercontent.com, not from your prospect. The open event itself approximately survives, but the IP address, device, browser and location attached to it describe Google's infrastructure. Every "opened in Sydney on an iPhone at 9:04am" row for a Gmail-hosted recipient has been fiction for over a decade. This is worth sitting with: the industry treated open metadata as real for years after one of the two mailbox duopolists had already replaced it with a proxy's details.
At the classic Outlook client, real reads vanish. Microsoft's desktop Outlook, still the workhorse client of the enterprise segment, blocks automatic picture downloads from external senders by default. Microsoft documents this plainly, and notes that admins can enforce it organisation-wide. A prospect on this default who reads your email attentively, start to finish, fetches no pixel and generates no open. Your most engaged enterprise reader is invisible unless they click.
At the Apple Mail client, opens are fabricated on receipt. Where the reading app is Apple Mail, on the iPhone a prospect reads their work mailbox with in the evening, Mail Privacy Protection fetches remote content through Apple's relay "in the background when you receive a message (instead of when you view it)", in Apple's own words. Every such recipient registers an open for every message, including the ones deleted unread. Note what this is and is not: it is a client behaviour, not a mailbox one, so it applies to Microsoft- and Google-hosted mail whenever an iPhone is the reader.
You will see claims that Apple Mail is half of all email opens. We are deliberately not building on that number, for a reason worth making explicit: client market share is itself measured in opens, and MPP manufactures opens. Apple's share of opens therefore overstates Apple's share of actual readers, and the statistic partly measures the very distortion it gets cited to describe. In a B2B list the honest statement is smaller and still damaging: some unknowable fraction of your recipients read work mail through Apple Mail, and for that fraction your open data is fabricated at delivery time.
Teams that know about gateways and MPP usually respond by discounting. Assume a third of the events are fake, haircut the rate, move on. That reasoning fails, and it fails for a reason worth sitting with.
The distortions do not share a sign.
A single campaign therefore contains phantom engagement from people who never looked, and invisible engagement from people who read every word. A blanket discount corrects neither. It scales down a total that was assembled from two opposite errors, and produces a number that is differently wrong.
To actually calibrate you would need to know, per recipient, whether their gateway detonates, whether their client pre-fetches, and whether their reading pane loads images. Those are properties of the recipient's employer's IT policy. You have no visibility into them, and they change without telling you.
This is the finding that should change how you read a campaign report, and it follows directly from who buys security software.
Defender for Office 365, Proofpoint and Mimecast are enterprise products. Deployment correlates with headcount, with regulated industries, and with having a CISO. The enterprise segment also skews toward Microsoft hosting, the side of the duopoly where the documented pre-delivery scanning lives. Which means the fraction of your metrics that is machine-generated rises with the size and seniority of the account.
Turn that around and it is genuinely uncomfortable. The enterprise segment in your reporting, the accounts with the largest contract values and the longest cycles, is the segment whose engagement numbers are least real. A ten-person startup on plain Google Workspace gives you comparatively honest data. A bank gives you a beautiful click rate generated substantially by its own security appliance.
If you have ever wondered why an enterprise campaign posted a spectacular click rate and produced no meetings, this is a sufficient explanation on its own. You were not looking at demand. You were looking at a security product doing its job.
A wrong number in a dashboard is an annoyance. These numbers are wired into automation, and that is what turns a measurement problem into an operations problem.
Follow that last one to its end. Over several hygiene cycles the list drifts toward addresses with high machine activity and away from quiet humans. The reported engagement rate goes up. The pipeline does not.
Everything so far concerns messages that were delivered. The second failure is quieter, because a message that is never delivered generates no metric at all, and an absence never appears in a report.
Since February 2024, Google and Yahoo have enforced requirements on bulk senders: SPF, DKIM and DMARC authentication, one-click unsubscribe via RFC 8058, and a spam-complaint rate that Google asks senders to keep under 0.1%, with 0.3% as the line above which delivery degrades. Microsoft has since followed with equivalent requirements. These are not guidelines; non-compliant mail is rejected or filed as spam.
Corporate mail systems add their own layer on top, and this is where B2B diverges sharply from consumer email:
p=reject on the recipient side, plus strict enforcement of alignment, rejects anything that fails authentication outright.None of this produces a bounce you can see. Quarantined mail is accepted by the receiving server. As far as your platform is concerned, it was delivered successfully. The absence of a complaint is read as a positive signal. Your dashboard shows a healthy delivery rate for a message sitting in a folder nobody opens.
Every major marketing automation platform now ships bot filtering, which is worth reading as a confession: the industry that sells engagement metrics has conceded that a material share of them are machine-generated. What each platform does about it differs, and the differences are instructive.
HubSpot filters by default. Its documentation says bot activity is identified "by analyzing identifying information (e.g. IP addresses present on referrer blocklists) and behavioral patterns (e.g. how quickly interactions are taking place)", and explicitly includes Apple's Mail Privacy Protection and corporate screeners such as Mimecast in what gets removed. The algorithm and thresholds are unpublished, so you are trading one unverifiable number for a different unverifiable number with an undisclosed amount subtracted. HubSpot itself warns its filtered figures will read lower than other platforms', which quietly concedes the larger point: every platform applies a different unpublished correction, so cross-platform benchmarks in this category are meaningless.
Marketo is the most honest of the three, because it shows its working. Two documented methods, each switchable: matching activity against the Interactive Advertising Bureau's bot list, and a proximity rule under which "when two or more activities happen at the same time (in under a second), they're identified as bots". Crucially, each method can be set to log rather than filter, flagging the activity while keeping it queryable. Marketo is the only major platform that lets you measure your own machine-traffic rate instead of trusting a vendor's deletion. Its weaknesses are structural rather than of intent: the IAB list catalogues advertising crawlers, not mail-security gateways, and a proximity rule needs two near-simultaneous events, which a single-CTA email never produces.
Eloqua runs automatic click-pattern detection you cannot configure, and it has a design decision that actively makes the problem worse. Oracle's documentation states that "if a clickthrough occurs, Oracle Eloqua determines whether or not an email open recorded for the RecipientID. If not, then an email open is also recorded along with the clickthrough to 'assume an email open'." The intent is reasonable, recovering opens from image-blocking readers. The consequence in B2B is that a gateway's pre-delivery link fetch produces a fake click and then manufactures a fake open to accompany it. One machine event becomes two human-looking events, and the synthesised open is indistinguishable from a real one downstream.
And here is what all three share, which is the point: every one of them only subtracts. Not one can add back the enterprise reader who studied your email with images blocked and generated nothing. Bot filtering shrinks the inflation and leaves the suppression untouched, so a filtered number is still biased low by an unknown amount. The measurement problem is not being solved. It is being managed out of sight, differently by each vendor.
Put the halves together and they feed each other.
Machine-inflated engagement makes a channel look more productive than it is. A channel that looks productive gets more volume. More volume to colder lists raises complaint rates and increases the chance of hitting spam traps, which degrades sender reputation. Degraded reputation means more quarantine and more rejection, which removes real humans from your reachable population while leaving the machine traffic that never complains. The remaining engagement signal is now an even higher proportion machine, which makes the channel look productive again.
Each turn of that loop makes the reported number better and the actual result worse. It is not a slow drift toward noise, it is a bias that compounds in a specific direction, and the direction is the one that feels like success.
You do not need a vendor to find out how bad your own numbers are, and given the width of every industry estimate, measuring beats quoting. Four tests, in ascending order of effort:
Run the honeypot for a month and you will have a defensible per-campaign correction factor, measured on your own list rather than borrowed from a 2020 industry paper. Note it still tells you nothing about the suppression side; nothing does.
The useful question is not "which metric is clean", it is which events require a human to have decided something. Ranked by how hard they are to fake:
Notice what every reliable item shares: it is generated by a person choosing to do something, inside a system that knows a person did it. Everything unreliable is passive, inferred from infrastructure behaviour that happens whether or not a human was present.
That is the actual dividing line, and it is worth stating plainly, because it generalises well beyond email. Observed signals degrade as the observation gets cheaper to fake. Declared signals do not. An open is observed. A reply is declared.
Being precise about this, since the point of the page is that unverifiable numbers are worthless. Moniker is not an analytics product and does not fix anyone's email reporting.
What it changes is the unit you buy. On Moniker a vendor does not buy a contact record and then try to infer interest from pixel fetches. The buyer has declared what they are evaluating, verified a business email, and is asked whether they want to hear from you. You are charged only when they say yes.
An acceptance cannot be produced by a security gateway. There is no configuration of Defender, Proofpoint or Mimecast that agrees to a conversation on a buyer's behalf. It is an affirmative action by an authenticated human inside a product, which puts it in the same category as a reply and a booked meeting rather than in the category of opens and clicks.
That is a smaller number than your current open rate. It is a smaller number than your current click rate. It is a number that means something, and the argument of this page is that those are not the same axis.
See how Moniker works for vendors → I'm a buyer, get my Moniker →