> For the complete documentation index, see [llms.txt](https://doc.batch.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.batch.com/guides-and-best-practices/email-deliverability/reputation-and-performance-monitoring/unsubscribes/why-click-or-unsubscribe-rates-look-abnormally-high-on-office-365-proofpoint.md).
# Why Click or Unsubscribe Rates Look Abnormally High on Office 365 / Proofpoint
Understand how security gateways can inflate your click and unsubscribe stats without any real engagement from your readers.
A sudden spike in clicks or unsubscribes, concentrated on a single mailbox provider, isn't always a sign of a content or targeting issue.
If your audience includes business email addresses, it's often a sign that the recipient's email security gateway scanned the message on their behalf. The gateway opens the email and clicks its links before a human does, and each of these actions is recorded as a real open, click or unsubscribe.
{% hint style="info" %}
This is common with corporate email security solutions: **Proofpoint**, **Microsoft Defender / Safe Links**, **Mimecast**, **Cisco Secure Email (ESA)**. More broadly, it can happen with any spam filter or security solution commonly used in B2B environments, not just these examples. It mainly affects sends to business domains (B2B).
{% endhint %}
### How to recognize this case
A few signals, often combined, point to this:
* Click and/or unsubscribe rate on a campaign is significantly higher than usual, and concentrated on one or a few mailbox providers (Office 365, Proofpoint, Cisco Ironport...).
* This spike isn't matched by real engagement: no increase in replies, site visits or conversions.
* Recipients tell you they never clicked "unsubscribe," or that they never received the email at all, despite a recorded bounce.
* The pattern often shows up around a higher-than-usual send volume to business domains.
{% hint style="success" %}
Use the **Mailbox provider** filter in **Analytics > Email** on your dashboard to check this yourself: if the abnormal click/unsubscribe rate is concentrated on Office 365, Proofpoint, or a similar security vendor, that's a strong indicator.
{% endhint %}
For example, a campaign might show a click rate of around 2–3% on Gmail, Apple, Yahoo and Orange, but 18% on Office 365 / Proofpoint. A spike on one provider only is a strong sign of automated clicks, not real engagement.
### The mechanism
Email security gateways don't wait for a person to open the email before acting on it. Four things can happen before your reader even sees the message:
1. **Automatic pre-fetch.** The message is opened and scanned by the gateway before it reaches the inbox, which can register as an open without a real person involved.
2. **Automatic clicks on every link.** To check that no link leads somewhere malicious, the gateway clicks every URL in the message itself, including the unsubscribe link. That click registers as a real unsubscribe, with no action from the recipient.
3. **Possible repetition.** This can happen again on later sends to the same address, and sometimes more than once for a single email.
4. **Impact on bounces.** During an unusual volume spike, some of these gateways may also block or defer part of your traffic, generating hard bounces (e.g. "550 Invalid Recipient") that don't reflect a genuinely invalid address.
The result: inflated opens, clicks and unsubscribes.
### What can (and can't) be done
{% hint style="danger" %} **Limitation**\
There's currently no reliable way to exclude these automated clicks from your unsubscribe or click counts: the underlying data doesn't distinguish a bot click from a human one.
{% endhint %}
The one mitigation available today: add a **confirmation step** to your unsubscribe landing page, so a click from the email leads to a page requiring explicit confirmation (for example, "Do you really want to unsubscribe?" with a **Confirm** button) rather than unsubscribing immediately. The gateway's automated click opens the page but never presses Confirm, so only real readers who confirm are unsubscribed.
{% hint style="warning" %}
**Important**\
This confirmation step applies only to the unsubscribe **landing page** linked in the body of your email. It doesn't apply to the **one-click unsubscribe** offered by the `List-Unsubscribe` header (RFC 8058), which Gmail and Yahoo require for bulk senders: that mechanism must keep working without any confirmation. Don't disable or modify it.
{% endhint %}
### What this means for your metrics
This isn't a content problem, and it doesn't reflect a real loss of subscribers. It does distort your engagement stats: inflated opens and clicks that don't correspond to genuine interest, worth factoring in when reading performance for B2B-heavy segments.
If hard bounces spike alongside this pattern following a sudden volume increase, a gradual ramp-up to business domains, rather than a one-off mass send, reduces the risk of triggering these gateways' protective filtering.
#### Checklist
* [ ] Check the Mailbox provider filter: is the spike concentrated on Office 365 / Proofpoint / a security vendor?
* [ ] Confirm with affected recipients whether they actually clicked unsubscribe.
* [ ] Check whether a higher-than-usual volume was sent to business domains around the same time.
* [ ] Consider adding a confirmation step to your unsubscribe landing page (not to the `List-Unsubscribe` one-click header).
{% hint style="info" %}
**Read more**
* [Common Footer & Unsubscribe Link Mistakes (and How to Fix Them)](https://doc.batch.com/guides-and-best-practices/message/email/troubleshooting/common-footer-and-unsubscribe-link-mistakes-and-how-to-fix-them)
* [Email Bounces: Types, Causes, and Handling ](https://doc.batch.com/guides-and-best-practices/email-deliverability/list-hygiene-and-recipients-management/email-bounces-types-causes-and-handling)
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://doc.batch.com/guides-and-best-practices/email-deliverability/reputation-and-performance-monitoring/unsubscribes/why-click-or-unsubscribe-rates-look-abnormally-high-on-office-365-proofpoint.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
