A complete technical reference covering capture infrastructure, DNS authentication probing, ESP fingerprinting, creative intelligence, AI flow detection, and everything in between.
How Competitor Inbox intercepts and stores every email your competitors send.
Every competitor you track is assigned a dedicated email address hosted on Competitor Inbox infrastructure. When you add a competitor (e.g. acme.com), you receive a unique address like acme-xxxxxxxx@capture.competitorinbox.com. You then subscribe to that competitor's mailing list using this address.
When the competitor sends a campaign, our inbound mail gateway receives and processes it within seconds. The full MIME message — including headers, all body parts, and attachments — is parsed and stored in our database linked to your competitor record.
For every inbound message we capture:
• Full HTML and plain-text body
• All headers (From, Reply-To, List-Unsubscribe, X-Mailer, X-Mailer-ID, DKIM-Signature, etc.)
• Envelope sender and Return-Path (used for ESP detection)
• Subject line, preheader, and send timestamp
• All links and their destinations
• Embedded image URLs and tracking pixel domains
• BIMI logo URL (if present in DNS)
None of the personal tracking parameters in the email are triggered — we process the raw message without loading external resources in a browser.
If you track the same competitor from multiple accounts, or if a competitor sends to multiple addresses you own, the system uses a combination of the Message-ID header and a content hash to de-duplicate at ingestion time. Only one canonical copy is stored; all inboxes that received it reference the same record.
Team plans allow multiple users to share a competitor inbox. Every team member sees the same email feed, analytics, and alerts. Adding or removing team members from a competitor does not change the capture address or subscription status.
How our DNS probe checks SPF, DKIM, and DMARC for every sender domain.
Every email sender domain is probed in real time when a new email arrives. The Auth Score is a 0–100 composite that reflects how well a sender's DNS records protect their deliverability:
• SPF record present and valid (+25)
• DKIM signature present and verifies (+25)
• DMARC policy published (+20)
• DMARC policy is "reject" or "quarantine" rather than "none" (+15)
• BIMI record with verified logo present (+15)
A score above 80 indicates strong authentication. Scores below 40 suggest a sender is at significant deliverability risk.
We perform a live DNS TXT lookup on the RFC5321.MailFrom domain (the envelope sender / Return-Path). We parse the SPF record, resolve all include: and redirect= mechanisms, and flag common misconfigurations: more than 10 DNS lookups (PermError), use of +all (effectively bypass), or no record at all.
The result is cached for 12 hours, then re-probed on next email receipt or on your manual refresh.
The DKIM-Signature header embeds a selector and signing domain (d= and s=). We construct the public key DNS query (selector._domainkey.signingdomain) and verify the message body and headers against the RSA or ed25519 key. We record:
• Selector used
• Signing domain
• Algorithm (rsa-sha256 / ed25519-sha256)
• Whether verification passed
Multiple DKIM signatures (common when mail passes through a rebroadcast service) are all evaluated.
DMARC aligns SPF and DKIM with the RFC5322.From domain. We look up the _dmarc.domain TXT record, parse the p= (policy), sp= (subdomain policy), rua= (aggregate report URI), and pct= (percentage) tags. A policy of "reject" is the gold standard; "none" means the record exists but provides no real protection.
Brand Indicators for Message Identification (BIMI) lets email clients display a verified brand logo next to authenticated emails. We query the default._bimi.domain DNS record for an SVG logo URL. If present, we fetch and store the logo, which appears in the Competitor Inbox UI alongside that sender's profile.
How we fingerprint which email service provider each competitor uses — and alert you when they switch.
We match over 20 signals against a database of ESP signatures:
• Return-Path / envelope sender domain (e.g. em.salesforce.com → Salesforce Marketing Cloud)
• X-Mailer and X-Mailer-ID header values
• DKIM signing domain (many ESPs sign with their own domain: mailchimp.com, sendgrid.net, etc.)
• Tracking pixel and link-tracking subdomain patterns
• List-Unsubscribe header format
• X-Feedback-ID and X-SES-ID style headers
Each rule is assigned a confidence weight. The winning ESP must clear a threshold before we record it.
We currently detect 100+ providers including: Mailchimp, Klaviyo, Salesforce Marketing Cloud, HubSpot, ActiveCampaign, Brevo (Sendinblue), Constant Contact, Campaign Monitor, Drip, Omnisend, Iterable, Braze, Marketo, Pardot, SendGrid (Twilio), Amazon SES, Postmark, Listrak, ConvertKit, Mailgun, Customer.io, Keap, Beehiiv, Substack, OneSignal, CleverTap, MoEngage, Airship, MailerLite, Zoho Campaigns, Resend, Loops.so, and many more.
See the full list at competitorinbox.com/how-it-works/esp-detection
Once an ESP is recorded for a sender, every subsequent email is re-fingerprinted. If the new email's fingerprint resolves to a different ESP, a TemplateChangeDetected flag is raised and a "Provider Switch" event is logged. If you have email alerts enabled for that competitor, you'll receive a notification within minutes of the switch being confirmed.
How we extract design hashes, color palettes, CTA signals, and layout data from raw email HTML.
We pass each email's HTML through a normalization pipeline that strips dynamic content (personalization tokens, product blocks, dates, prices). The resulting stable HTML is hashed (SHA-256). If the hash changes between two emails from the same sender, we flag TemplateChangeDetected = true.
This means you'll know the moment a competitor refreshes their email template — even if the subject line and copy are similar.
We scan the email's CSS and inline styles for color values (hex, rgb, hsl). The top 5 most-used colors are stored in ColorPaletteJson. This lets you see whether a competitor shifted their brand color, ran a seasonal campaign with different hues, or is A/B testing button colors.
Every anchor tag in the email body is extracted. We categorize CTAs by type: shop-now, learn-more, get-started, download, watch, redeem, claim-offer, and others. CtaCount records the total number; CtasJson stores the text and href of each. HasMultipleCtas is true when more than three distinct CTAs appear — a common pattern in digest and re-engagement emails.
LayoutColumns records whether the email uses a single-column, two-column, or three-plus-column grid. HasHeroImage is true if a large image appears in the first 20% of the email body. HasGif and HasVideo detect animated GIF embeds and video thumbnails (or actual video embeds) respectively. ImageToTextRatio measures the proportion of visual to written content.
PersonalizationScore (0–100) measures how personalized an email appears based on merge tag density, conditional block markers, and product recommendation blocks. PersonalizationTokenCount is the raw count of tokens like {{first_name}}, {%- if -%}, and similar. HasPersonalization is the boolean shortcut.
We extract OfferType (discount / free-shipping / bundle / product-launch / none), DiscountAmount, DiscountPercent, UrgencyScore (0–100), SubjectHasUrgency, SubjectHasDiscount, SubjectHasQuestion, HasCountdown, HasLimitedStock, HasFreeShipping, HasBundle, and HasProductLaunch. These signals let you build a picture of how aggressively each competitor promotes at different times of year.
Calendar heatmaps, frequency metrics, and timing intelligence for every competitor.
Send times are plotted on a week × hour heatmap showing which day/time combinations each competitor favors. The heatmap updates in real time as new emails arrive and covers a rolling 90-day window by default. You can extend the window to 12 months for seasonal pattern analysis.
We track emails per day, per week, per month, and per quarter. Sudden frequency spikes are surfaced as "Campaign Burst" events. Drops below the rolling 30-day average trigger "Frequency Drop" alerts — useful for spotting when a competitor pauses their program.
SendDayOfWeek (0 = Sunday … 6 = Saturday) and SendHour (0–23 in UTC) are stored on every email record. These aggregate into delivery window profiles so you can see, for example, that Competitor A sends 80% of emails on Tuesday and Thursday mornings.
Emoji usage, urgency keywords, personalization tokens, A/B test detection, and semantic similarity.
For every email we compute: SubjectLength (character count), SubjectWordCount, SubjectEmojiCount, SubjectAllCapsRatio (proportion of capital letters), SubjectHasDiscount (price or % mention), SubjectHasUrgency (words like "last chance", "today only", "expires"), SubjectHasQuestion, and SubjectHasPersonalization (merge tags).
SubjectPowerWordsJson stores a list of high-impact words found in the subject (e.g. "free", "exclusive", "new", "guaranteed", "secret"). Power words are correlated with open-rate performance in our benchmark data set, so you can see which words high-performing senders favor.
SubjectSimHash is a perceptual hash of the subject's semantic content. Two subjects with the same SimHash are nearly identical in meaning even if the phrasing differs slightly. We use this to detect A/B tests (PossibleAbTest = true) where a competitor sends near-identical campaigns within a short window.
If two emails from the same sender arrive within 2 hours and share a nearly identical HTML body but differing subject lines, we set PossibleAbTest = true on both records. In the dashboard, these are grouped together and tagged with a "Test" badge so you can compare variants side-by-side.
AI-powered identification of welcome series, abandoned cart, and other automated sequences.
We use a combination of timing gaps, FunnelStage labels, and content classifiers to identify when a series of emails form an automated sequence:
1. Welcome Series — first email arrives within 5 minutes of subscription; subsequent emails are 1–3 days apart with consistent branding.
2. Abandoned Cart — contains product imagery + a clear "come back" CTA; follows a 1h / 24h / 72h cadence pattern.
3. Re-engagement — low send frequency followed by a spike; subject lines include lapsed-time references.
4. Post-Purchase — sent within 48h of a transactional trigger; contains order confirmation, shipping, or review-request patterns.
5. Promotional Burst — 3+ emails in 7 days with consistent offer framing.
Every email is tagged with one of: awareness, consideration, conversion, retention, reactivation, or transactional. This lets you filter IntelligenceReports by funnel stage and understand where a competitor focuses their email investment.
When two or more emails are grouped into a detected sequence, the dashboard shows a timeline card with each email in order, the time gap between sends, and the detected FunnelStage of each step. You can open any email in the sequence to see its full HTML.
How every competitor is automatically classified into an industry vertical.
When a new competitor domain is added, we run it through a multi-signal classifier:
1. Domain category from our industry database (500k+ domains pre-labeled)
2. Homepage meta keywords and og:description if present
3. Email content signals (product category keywords, pricing pages, branded product references)
4. SIC/NAICS code mapping via company data enrichment
The top-confidence industry from these signals is stored and used for benchmark comparisons.
Current industry verticals include: E-commerce / Retail, SaaS / Software, Financial Services, Healthcare & Wellness, Travel & Hospitality, Media & Publishing, Real Estate, Education, Non-profit, Food & Beverage, Fashion & Apparel, Beauty & Personal Care, Automotive, B2B Services, and Agency / Marketing.
The Email Benchmarks page shows average open rates, click rates, and send frequencies segmented by industry. When you view a competitor's profile, their metrics are compared against the industry average for their vertical — not the global average — giving you a more meaningful performance context.
SPF, DKIM, DMARC signals and how they relate to inbox placement.
A competitor with poor DNS authentication is at higher risk of Gmail and Outlook spam-filtering their campaigns. If you see their engagement drop while their Auth Score is below 40, that's a meaningful signal — their strategy may be degrading because consumers never see the emails, not because the content is bad.
Many ESPs use a branded click-tracking domain (click.company.com). If that domain changes between emails, we set TrackingDomainChanged = true. This can indicate an ESP switch, a reputation reset (migrating to a clean domain), or a deliverability triage action.
The admin global inbox shows SPF ✓, DKIM ✓, and DMARC ✓ chips on each email row. Green chips indicate passing checks. Grey chips indicate the record is missing. Clicking a chip opens the raw DNS record for that check so administrators can investigate immediately.
Where benchmark data comes from and how it's segmented.
Our benchmark dataset is built from two sources:
1. Aggregated anonymized send / engagement statistics contributed by our user base (opt-in only).
2. Publicly available industry reports from Mailchimp, Klaviyo, Litmus, and Campaign Monitor, normalized to a consistent methodology.
Data is refreshed quarterly. The Email Benchmarks page currently holds 790+ metric snapshots across 15 industries.
Current benchmark metrics: open rate, click-through rate, click-to-open rate, unsubscribe rate, bounce rate (hard + soft), emails per month, send day distribution, subject line length average, emoji usage rate, mobile open rate share, and dark-mode open share.
If you manage an email program and want to contribute aggregated stats, visit /contribute. Contributions are anonymized and your brand is never associated with the numbers. Contributors get access to premium benchmark segments not available to the general public.
Start monitoring your competitors' email activity in under 5 minutes. No credit card required to try.