strayprocess.com

My goal was to have Mail.app (the built in email client in OSX) refrain from downloading remote images referenced in emails and also display emails as plain text. I thought that this should be a pretty easy task, but it doesn't seem to be supported by Apple.

Under Mail: Preferences->Viewing, you can uncheck the "Display remote images in HTML messages" option which is supposed to prevent the loading of remote images. While there isn't a checkbox to display emails as plain text, there are many references online to a hidden preference you can set from the command line to do this:

defaults write com.apple.mail PreferPlainText -bool TRUE

It turned out that setting these two preferences did not do what I had expected. Pretty quickly, I found two examples of where it just didn't work.

• If Mail.app reads a multipart MIME message with both a text/plain part and a text/html part, the text/plain part will be displayed (expected); however, any remote images referenced in the text/html part will still be downloaded from the remote site (unexpected).
• If Mail.app reads a message with only text/html content, it will display the email with the HTML formatting (not as text) and, despite your preference to prevent this, will download all images referenced in the HTML - it just won't show them to you.

From blog and forum posts I've seen, there are a lot of people who are using these two preferences together to try and increase security and prevent tracking of SPAM through web bugs. Unfortunately, it seems as though the options available are pretty ineffective. If you take the "Display remote images in HTML messages" text literally, you could argue that it is normal for the images to be downloaded and just not displayed. But, the Apple Help viewer for that preference states:

Display remote images and embedded objects when you view HTML messages.  
To view messages more quickly and to protect your privacy, it's recommended  
that you not select this option. 

If disabling remote images is supposed to protect someone's privacy, it implies that the images are not actually downloaded from the remote server. The image below is an HTML formatted SPAM message that I received today:

You can see that Mail.app will happily parse the HTML content, but what you can't see is that though you are presented with image placeholders that make you think that the images weren't retrieved, the images were still downloaded. Right after the email was retrieved from my mail server I see the following HTTP GET requests (which were confirmed to have been caused by Mail.app parsing the email):

GET /images/newsletter/april08/walgreens.gif HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/525.27.1 (KHTML, like Gecko)
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: images.walgreens.com
 
GET /urgent.jpg HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/525.27.1 (KHTML, like Gecko)
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: dmbvf.yaftutop.cn
 
GET /images/spacer.gif HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/525.27.1 (KHTML, like Gecko)
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: images.walgreens.com
 
GET /images/newsletter/april08/Blue_bar.gif HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/525.27.1 (KHTML, like Gecko)
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: images.walgreens.com
 
GET /urgent.jpg?yaftutop.cn HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_6; en-us) AppleWebKit/525.27.1 (KHTML, like Gecko)
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-us
Connection: keep-alive
Host: 115.126.5.240

The moral of the story... don't expect much from these preferences. From what I can tell, remote images in HTML emails are always retrieved (they just aren't presented to you) and the PreferPlainText preference is just that, a preference. To avoid the downloading of images, you can either use a different mail client or block it using something like LittleSnitch. To force plain text, it looks like you just have to use a different mail client.