What in­form­a­tion does the e-mail header contain?

The header of an e-mail is roughly divided into two cat­egor­ies: message headers and envelope headers. Message headers are generated directly by the re­spect­ive sender and then sent on their way to the recipient. While en route, the e-mail is expanded by envelope headers, which are created by the mail server during transfer. This extra in­form­a­tion (received lines) is fun­da­ment­al for tracing e-mails. Each line of an e-mail header begins with a keyword (the name), followed by a colon and then the content.

Hidden e-mail header in­form­a­tion

Return-Path: When available, this line is almost always at the beginning and gives the mail server a return option in case delivery is not possible. The delivered e-mail address is identical to the one that the server receives via the “envelope-from” in­form­a­tion.

Example: Return-Path: <return-address@example.com>

Received: Received lines are generated by the mail servers that are involved in the transfer. There are at least two of these lines per e-mail header since one server is used to send and one is used to receive. The lines reveal the e-mail’s trans­mis­sion route including the date and address of the mail server involved (usually inside square brackets)

• Example: Received: from hostname.example.com (hostname.example.com  [xxxxxxxx])

• by mailserv­er.recipient.com with SMTP

• for <recipient@example.com>; Thu, 24 Dec 2015 17:36:20

• +0200 (EST)  

Message-ID: Every e-mail contains this clear iden­ti­fic­a­tion, mostly from the mail servers or from the sender’s mail programme. The first part of the ID is made up of a character code, and the second part is a domain name, separated by an “@” sign.

Example: Message-ID: <434571BC.8070702@example.com>

Content-Type: In this line of the e-mail header you will find in­form­a­tion about the type and character set of the text body. The in­di­vidu­al para­met­ers are separated by semi­colons.

Example: Content-Type: text/plain; charset=UTF-8</recipient@example.com></return-address@example.com>

E-Mail header analyser: how it works

Before you can begin to analyse the header, you first need the complete excerpt. Since a standard e-mail programme conceals the relevant content for the transfer, it first needs to be uncovered. Open the re­spect­ive message in Microsoft Outlook followed by the complete address line: “File --> Info --> Prop­er­ties”. In Mozilla Thun­der­bird, activate the in­form­a­tion in the ap­plic­a­tion menu by clicking on “View --> Headers --> All”.

In order to identify the sender, you need to search the full header content for the IP address and the name of the first server that was involved in trans­mit­ting the message. Go through the different received in­form­a­tion from the top (your utilised mail server) until you find the outgoing mail server. This server usually con­sti­tutes the lowest received in­form­a­tion. Further in­form­a­tion found under the header is most likely the result of a fraud attempt and you should therefore assume that you have already found the outgoing mail server. Upon com­plet­ing this step, enter the IP address (which is indicated in the received in­form­a­tion) into a web tool such as Network-Tools.com. You will then receive in­form­a­tion about the server location. The result should match the name of the server that is shown in the iden­ti­fied time zone line.

If you don’t want to search for in­con­sist­en­cies in the received in­form­a­tion of the e-mail header yourself, you can use pro­grammes such as the free eToolz tool. Click on “E-Mail Header Analyzer” and enter the full header excerpt in the “E-mail Header” field to start the search. The ap­plic­a­tion lists all involved mail servers in chro­no­lo­gic­al order. Next to “sent from:” there is the IP address of the first server that you can check manually using Network-Tools.com.

How e-mail headers are spoofed

In most cases spammers have no interest in receiving answers to their e-mails. Normally whoever sends spam wants to stay anonymous. This means that the “from” and “return-path” lines of spam e-mails rarely speak the truth. The actual writers therefore use false iden­tit­ies. In the more recent past lots of e-mail re­cip­i­ents received mails allegedly from PayPal, eBay, or even from the local au­thor­it­ies. Apart from the fact that these e-mails encourage you to open external links, the fake addresses, for the most part, had a few sim­il­ar­it­ies to the original addresses and were quickly exposed as spam through an e-mail header analyser. It is often difficult to identify the actual creators of these spam e-mails due to the fact that such e-mails were sent via a mis­con­figured mail server or an infected computer. These serve as in­ter­me­di­ate stations during dispatch, which allows many spam senders to avoid being iden­ti­fied by the e-mail header.

The received in­form­a­tion is the only element of the e-mail header that cannot be faked. This is because spammers do not have access to the last piece of received in­form­a­tion that normally contains the output IP. This is generated from the recipient’s mail server. Ma­nip­u­lat­ing the lines helps the spammer in so far as to cause confusion and to throw the recipient off track. They achieve this by placing their own server part of the way through instead of at the beginning of the chain.