How to spot which ESP a competitor uses (from the email alone)
TL;DR
Every email leaks the platform that sent it. The link-wrapping host (list-manage.com = Mailchimp, kx.cdn = Klaviyo, email.beehiiv.com = Beehiiv) is the most reliable signal. The Return-Path, X-Mailer, tracking pixel, unsubscribe URL, UTM convention, and BIMI marker fill in the rest. With practice you can read any competitor's tech stack in under a minute.
An email can hide its content behind a paywall, behind login, behind anything. It cannot hide its plumbing. Every send leaks the routing data that made it possible - what platform sent it, which trackers it carries, which unsubscribe page it points to. Reading those signals is one of the most underused competitive-intelligence techniques in marketing. Here is how to do it.
The seven signals every email carries
1. Link wrapper host
The most reliable single signal. Every major ESP wraps outbound links through a domain it controls so it can track clicks. The host of the wrapper tells you the ESP:
list-manage.com → Mailchimpkx.cdn or trk.klclick.com → Klaviyoemail.beehiiv.com → Beehiivlinks.iterable.com → Iterablee.customeriolinks.com → Customer.ioconvertkit-mail.com → ConvertKit / Kitmlsend.com → MailerLiteactivehosted.com → ActiveCampaignemail.substack.com → Substackemail.beehiiv.com → Beehiivr20.rs6.net → Constant Contactsendgrid.net → SendGrid (transactional or via builder)2. Return-Path / bounce domain
Visible in the full email headers. ESPs use a recognisable subdomain pattern - bounce@em.iterable.com for Iterable, bounces+...@em.beehiiv.com for Beehiiv, bounce-{id}@bounce.list-manage.com for Mailchimp.
3. X-Mailer or X-Mailgun-* headers
Some ESPs identify themselves with a header. Customer.io includes X-Mailer: Customer.io; Mailgun adds X-Mailgun-Sending-Ip; older ESPs and some SaaS systems still ship X-Mailer values that name the platform outright.
4. Tracking pixel host
The 1×1 pixel that fires on email open carries its own host signature. track.litmus.com means Litmus tracking is bolted on; open.beehiiv.com is Beehiiv's native tracker; track.customer.io is Customer.io. Pixel hosts often differ from link-wrapper hosts on the same email.
5. Unsubscribe landing page
The unsubscribe URL points to the ESP's hosted page in most setups. unsubscribe.beehiiv.com, substack.com/account, account.iterable.com/unsubscribe. Hover over the unsubscribe link without clicking and the destination tells you the ESP.
6. UTM convention
The default UTM parameters baked into the link wrapping leak the ESP's internal taxonomy. Klaviyo defaults to utm_source=klaviyo; Mailchimp defaults to utm_source=newsletter&utm_medium=email; Iterable adds utm_campaign={{campaignId}}. The pattern is recognisable even when the brand customises it.
7. BIMI / DKIM signing domain
The DKIM signature header reveals which domain signed the message. Brands sending direct via their own domain show that domain in the DKIM d= tag; brands sending via Mailchimp show d=mailchimp.com or a Mailchimp subdomain unless they configured custom domain authentication. BIMI presence (a verified logo in the inbox row) signals the brand has invested in deliverability seriously.
Why it matters: three use cases
Sales prospecting
If you sell into the email-marketing stack, building prospect lists by ESP is the most efficient targeting move you can make. "Every B2B SaaS company on Mailchimp under 50 employees" is a much sharper list than "B2B SaaS companies."
Migration windows
An ESP migration is the strongest single buy-signal in this market. Companies migrating from Mailchimp to Klaviyo are usually scaling up and reassessing their entire email stack. Companies migrating from Klaviyo to Iterable or Customer.io are usually professionalising lifecycle. Catching the migration in flight is the moment to reach out about adjacent tools.
Competitive intelligence
If your top three competitors all migrated from ESP A to ESP B in the last year, that is a signal. The migration timeline is also a leading indicator of bigger changes - new CMO, brand refresh, international expansion. Spot the technical change first.
The faster way: automatic detection
Reading headers manually is fine for one or two brands. For a watch list of 20 competitors, automate. Every newsletter forwarded to a Newsletrix address gets its ESP, tracker, UTM convention, and unsubscribe stack auto-detected, plus a migration timeline showing exactly when each tracked brand changed platforms.
Detect any brand's email stack
The ESP detector guide covers all 30+ supported platforms and the signals each one leaves.
Read the ESP detection guide →Frequently asked questions
Why know a competitor's ESP?
Sales prospecting, competitive intelligence, tooling decisions. Migrations are leading indicators of bigger shifts.
Most reliable signal?
The link-wrapper host. Every ESP wraps outbound links through its own domain.
Custom platforms?
Detect by elimination. If no fingerprint matches, the Return-Path and SMTP server reveal the underlying infrastructure.
How to view headers?
Gmail: Show original. Outlook: File → Properties. Apple Mail: View → Message → All Headers.
Spot migrations?
Yes - track a brand over time and watch the link-wrapper host change between sends.