High Opens and Clicks but Zero Replies? Bot Clicks Explained

If a cold campaign shows 80-90% opens, a healthy click rate and zero replies, the numbers are almost certainly machines, not people. Corporate security filters fetch every link in an incoming message to check it, and privacy features load images in the background. Both show up in your sequencer as opens and clicks. Real interest shows up as replies, booked meetings and form fills, so measure those and stop reading tracked clicks as intent.

This is one of the most repeated complaints on cold email forums: big open and click numbers, a Calendly link that "got clicked", and an empty calendar. Here is what is doing the clicking and how to tell.

Who clicks your links before your prospect does

Microsoft Defender Safe Links. Microsoft's Safe Links overview (updated October 2026) says that "URLs are scanned prior to message delivery, regardless of whether the URLs are rewritten or not", and that URLs that don't have a valid reputation "are detonated asynchronously in the background." Every Microsoft 365 business tenant with Defender for Office 365 gets this through the built-in protection policy, even if its admin never set up a policy.

Other secure email gateways. Mimecast, Proofpoint, Barracuda and similar products rewrite and check links too. Mailchimp's guide to bot clicks puts it plainly: "Each of these automated safety checks registers as a click in your analytics."

Privacy features that load images. Apple's Mail Privacy Protection downloads remote content privately in the background, so a tracking pixel can fire at delivery whether or not anyone read the message. That inflates opens, not clicks, but it's why opens alone mean little.

The more of your list sits behind enterprise filters, the worse this gets. Lists of software engineers, finance teams and large companies are mostly Microsoft 365 or gateway-protected, which is why one forum thread about a campaign aimed at engineers saw a 90% open rate and no replies at all.

How to spot machine clicks

Signal	Machine	Person
Time from delivery to click	Seconds	Minutes to days
Links clicked	Every link in the email, including the unsubscribe and signature links	One, sometimes two
Open recorded first	Often no open at all	Usually an open first
Pattern across a company	Several people at one domain click within the same minute	Scattered
What happens next	Nothing: no page scroll, no form, no booking	Page time, replies, bookings

You don't need special software to check. Export click events with timestamps from your sequencer, sort by recipient domain and time, and look for clusters. A click inside 60 seconds of the send time, or on the unsubscribe link of someone who never unsubscribed, is a machine.

To see in advance how much of a list sits behind Microsoft 365 or a gateway, run the domains through the bulk email provider lookup. It reads MX records and names the provider or gateway for each domain.

What to do about it

1. Measure replies, not clicks. For cold email, the numbers that matter are positive replies per 100 sent and meetings booked. Our post on open tracking and deliverability explains why many senders turn tracking off on cold steps altogether.
2. Keep links out of the first email. A first touch with no link gives scanners nothing to detonate and gives you a clean read on interest: a person has to reply.
3. Don't build follow-ups on "clicked" triggers. A sequence branch that sends a second pitch to everyone who clicked is a branch that pitches the security scanner.
4. Protect your own website if clicks spike. One long-running marketer described a client site going down every time a campaign went out, from tens of thousands of scanner clicks. Put landing pages behind a CDN cache and rate-limit by IP so a burst of scanner requests can't take the page down.
5. Filter in reporting. If your platform has bot filtering (Mailchimp and some others do), switch it on and leave it on so numbers stay comparable over time.

What machine clicks can and can't tell you

A scanner click does show that a filter on the recipient side received and processed your message. It doesn't show that the message reached the inbox: filters scan before they decide where to put it, so the same message can be clicked and then quarantined. Our guide to emails behind security gateways covers what a gateway means for both verification and delivery.

Clean data first, then judge the copy

Bot clicks hide a dead campaign. Bounces kill it outright. Before you rewrite copy because nobody replied, make sure the list isn't the problem:

1. Upload the list on the verify page. Every address gets a live mailbox check, and valid, risky and invalid download as separate files.
2. Send to the valid file first.
3. Treat risky as unconfirmed: catch-all business domains and Microsoft's consumer domains (outlook.com, hotmail.com, live.com) often can't be confirmed either way.

Where SimpleVerifier fits

The provider lookup is free and runs in your browser. For mailbox checks, the first 100 are free with a Google sign-in on the verify page. Starter is $9 a month for 2,500 checks, and Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off. See pricing.