{"id":11797,"date":"2023-05-05T10:34:51","date_gmt":"2023-05-05T10:34:51","guid":{"rendered":"https:\/\/www.icdsoft.com\/blog\/?p=11797"},"modified":"2024-02-29T12:35:04","modified_gmt":"2024-02-29T12:35:04","slug":"email-headers-made-easy-how-to-read-and-understand-them","status":"publish","type":"post","link":"https:\/\/www.icdsoft.com\/blog\/email-headers-made-easy-how-to-read-and-understand-them\/","title":{"rendered":"Email Headers Made Easy &#8211; How To Read and Understand Them"},"content":{"rendered":"\n<ul class=\"wp-block-advgb-summary advgb-toc alignnone\"><li class=\"toc-level-1\"><a href=\"#what-are-email-headers-6eedb378-183d-4945-9c26-88302b38816f\">What are email headers?<\/a><\/li><li class=\"toc-level-1\"><a href=\"#how-to-find-the-email-headers-e05f27c2-3da2-4566-a328-fea52d7d1e7c\">How to find the email headers?<\/a><\/li><li class=\"toc-level-1\"><a href=\"#which-are-the-most-important-headers-of-an-email-fccfb8b7-8fb5-49a8-bf34-e7f68f5b3249\">Which are the most important headers of an email?<\/a><\/li><li class=\"toc-level-1\"><a href=\"#reading-and-understanding-the-email-headers-c7cb321f-680d-4d16-ab08-6a5b23ea4e47\">Reading and understanding the email headers<\/a><\/li><li class=\"toc-level-1\"><a href=\"#in-conclusion-1437624e-4658-4726-883b-a66bb074811f\">In Conclusion<\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-are-email-headers-6eedb378-183d-4945-9c26-88302b38816f\">What are email headers?<\/h2>\n\n\n\n<p>Email headers contain valuable information about the path of the message from its initial sender to the final recipient. This includes IP addresses, server names, authentication data, originating entity to mention a few. This part of the email is usually hidden and can be analyzed by viewing the source code of the message. The email headers, however, could be modified by every server along the route and could be altered even upon sending due to a flaw in the global email system itself. <\/p>\n\n\n\n<p>For example, in the so-called spoofing attacks, the sender forges certain email headers in an attempt to trick the recipients of the message that the spoofed message originates from a legitimate source - their bank, a service provider, a popular website, etc. In such attacks, scammers take advantage of the flaws of the global email system to create a false sense of trust and deceive their victims so steal sensitive data, e.g. credit card information, website login credentials, mail passwords, etc.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-to-find-the-email-headers-e05f27c2-3da2-4566-a328-fea52d7d1e7c\">How to find the email headers?<\/h2>\n\n\n\n<p>Most email clients (desktop programs and web-based solutions) have the option to display the full headers of an email. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"686\" data-src=\"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/ShowEmailHeadersOutlook-1024x686.png\" alt=\"email headers\" class=\"wp-image-11923 lazyload\" data-srcset=\"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/ShowEmailHeadersOutlook-1024x686.png 1024w, https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/ShowEmailHeadersOutlook-300x201.png 300w, https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/ShowEmailHeadersOutlook-1536x1028.png 1536w, https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/ShowEmailHeadersOutlook-270x180.png 270w, https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/ShowEmailHeadersOutlook-770x515.png 770w\" data-sizes=\"(max-width: 1024px) 100vw, 1024px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 1024px; --smush-placeholder-aspect-ratio: 1024\/686;\" \/><\/figure>\n\n\n\n<p><a href=\"https:\/\/www.icdsoft.com\/en\/kb\/view\/1399_viewing_e_mail_message_headers\" target=\"_blank\" rel=\"noreferrer noopener\">We have published instructions for viewing the full email headers<\/a> in some of the most popular email clients, such as Outlook, Thunderbird, Mail for Mac, Windows Mail, Gmail, Hotmail.com\/Outlook.com\/Live.com, Yahoo Mail, etc. at the ICDSoft Knowledge Base:<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/www.icdsoft.com\/en\/kb\/view\/1399_viewing_e_mail_message_headers\" target=\"_blank\" rel=\"noreferrer noopener\">Viewing e-mail message headers<\/a><\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-are-the-most-important-headers-of-an-email-fccfb8b7-8fb5-49a8-bf34-e7f68f5b3249\">Which are the most important headers of an email?<\/h2>\n\n\n\n<p>Reading email headers is usually done for two reasons - checking if the email is legitimate or finding its real sender.  By analyzing the email headers, you can also find when the message was sent, and how long it took for it to be delivered. You can also find if you received it directly or as a forwarded message. Some of the most important headers are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>From<\/strong>: name and email address of the sender<\/li>\n\n\n\n<li><strong>To<\/strong>: name and email address of the recipient<\/li>\n\n\n\n<li><strong>Date<\/strong>: time and date when the message was sent, including the timezone of the sending system<\/li>\n\n\n\n<li><strong>Subject<\/strong>: shows the topic of the message<\/li>\n\n\n\n<li><strong>Return-Path<\/strong>: the email address to which a message can be returned in case it is not successfully delivered, e.g. in case of a server error, insufficient space, non-existent mailbox, etc.<\/li>\n\n\n\n<li><strong>Reply-To<\/strong>: the email address to which a recipient will respond if they decide to reply back to a message<\/li>\n\n\n\n<li><strong>Received<\/strong>: lists all mail servers through which a message has gone prior to arriving at its final destination; a message usually has more than one Received headers, and the first one shows the original sending server.<\/li>\n\n\n\n<li><strong>Delivered-To<\/strong>: shows the email address to which a received email was delivered; one message could have multiple Delivered-To headers due to email forwarding<\/li>\n\n\n\n<li><strong>DKIM-Signature<\/strong>: this is the text value of the DKIM record added to the message to allow validation<\/li>\n\n\n\n<li><strong>Received-SPF<\/strong>: an advisory header showing whether the IP address through which the message was sent is designated as a permitted sender<\/li>\n\n\n\n<li><strong>Authentication-Results<\/strong>: shows whether SPF, DKIM, and DMARC checks pass or not<\/li>\n\n\n\n<li><strong>Message-ID<\/strong>: a unique combination of letters and numbers that identifies each message; this globally-unique identifier can be used to distinguish one message from other emails<\/li>\n\n\n\n<li><strong>User-Agent<\/strong> or <strong>X-Mailer<\/strong>: shows the name of the email program used for sending the message<\/li>\n\n\n\n<li><strong>MIME-Version<\/strong>: Multipurpose Internet Mail Extensions (MIME) is an internet standard of encoding, which converts non-text content (images, videos, and other attachments) into text, so they can be attached to an email and sent via SMTP <\/li>\n\n\n\n<li><strong>X-Originating-IP<\/strong>: shows the IP address of the original sender; this header is not always present, so you may have to look for the first <strong>Received <\/strong>header instead.<\/li>\n<\/ul>\n\n\n\n<p> <\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"reading-and-understanding-the-email-headers-c7cb321f-680d-4d16-ab08-6a5b23ea4e47\">Reading and understanding the email headers<\/h2>\n\n\n\n<p>Let's dissect a few emails and their email headers.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Received: from CPWPR80MB6141.lamprd80.prod.outlook.com (2603:10d6:103:10f::10)\n by SCZPR80MB6981.lamprd80.prod.outlook.com with HTTPS; Mon, 10 Apr 2023\n 20:38:29 +0000\nReceived: from DS7PR03CA0238.namprd03.prod.outlook.com (2603:10b6:5:3ba::33)\n by CPWPR80MB6141.lamprd80.prod.outlook.com (2603:10d6:103:10f::10) with\n Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.34; Mon, 10 Apr\n 2023 20:38:27 +0000\nReceived: from DM6NAM10FT094.eop-nam10.prod.protection.outlook.com\n (2603:10b6:5:3ba:cafe::26) by DS7PR03CA0238.outlook.office365.com\n (2603:10b6:5:3ba::33) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.36 via Frontend\n Transport; Mon, 10 Apr 2023 20:38:26 +0000\n<strong>Authentication-Results<\/strong>: spf=pass (sender IP is 192.252.146.28)\n smtp.mailfrom=icdtest.net; dkim=pass (signature was verified)\n header.d=icdtest.net;dmarc=bestguesspass action=none\n header.from=icdtest.net;compauth=pass reason=109\n<strong>Received-SPF<\/strong>: Pass (protection.outlook.com: domain of icdtest.net designates\n 192.252.146.28 as permitted sender) receiver=protection.outlook.com;\n client-ip=192.252.146.28; helo=s466.sureserver.com; pr=C\nReceived: from s466.sureserver.com (192.252.146.28) by\n DM6NAM10FT094.mail.protection.outlook.com (10.13.153.58) with Microsoft SMTP\n Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id\n 15.20.6298.26 via Frontend Transport; Mon, 10 Apr 2023 20:38:26 +0000\nX-IncomingTopHeaderMarker:\n OriginalChecksum:297C7E56DB8DA6E6AC3DB36FDFECEAF23A80446DD23588094814949752EC5A1E;UpperCasedChecksum:FF301AF182321DCE2B20470C944DE12327C269E3E917E3EA6E2B9F88FB3CE6BB;SizeAsReceived:1059;Count:13\n<strong>DKIM-Signature<\/strong>: v=1; a=rsa-sha256; c=relaxed; d=icdtest.net; h=\n\tmessage-id:date:mime-version:to:from:subject:content-type\n\t:content-transfer-encoding; s=dkim; bh=fdkeB\/A0FkbVP2k4J4pNPoeWH\n\t6vqBm9+b0C3OY87Cw8=; b=ibNFtfV9TDB2T9WLkpQgr7Cz+nnjLhALlKhp9t1U2\n\tq\/6KbP8Gyr0C1KjngkzdfsFAGtSRlgX9iMeMaqYbyIUbMdePSr0t8cp\/DqCkVKOH\n\tfDTUgqxjt4xU\/M8d41n3z1fMZna8PXTeDmtyKPobwdNEqUuCWBvh+KTsdwZ5EPMA\n\tWs=\nReceived: (qmail 54628 invoked by uid 1003); 10 Apr 2023 20:38:25 -0000\n<strong>Received<\/strong>: from unknown (HELO ?213.145.98.191?) (johnsmith@icdtest.net@213.145.98.191)\n  by s466.sureserver.com with ESMTPA; 10 Apr 2023 20:38:25 -0000\n<strong>Message-ID<\/strong>: &lt;85333e2f-c72f-96ec-6d2c-dae495f8ee96@icdtest.net&gt;\n<strong>Date<\/strong>: Mon, 10 Apr 2023 23:38:22 +0300\n<strong>User-Agent<\/strong>: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko\/20100101\n Thunderbird\/102.6.1\nContent-Language: bg, en-US\n<strong>To<\/strong>: icdsoft@hotmail.com\n<strong>From<\/strong>: John Smith ICDSoft &lt;johnsmith@icdtest.net&gt;\n<strong>Subject<\/strong>: Test\nContent-Type: text\/plain; charset=UTF-8; format=flowed\nContent-Transfer-Encoding: 7bit\nX-IncomingHeaderCount: 13\n<strong>Return-Path<\/strong>: johnsmith@icdtest.net\nX-MS-Exchange-Organization-ExpirationStartTime: 10 Apr 2023 20:38:26.3714\n (UTC)\nX-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit\nX-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000\nX-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit\nX-MS-Exchange-Organization-Network-Message-Id:\n e510d1e0-8d30-4dd0-b95c-08db3a03892b\nX-EOPAttributedMessage: 0\nX-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0\nX-MS-Exchange-Organization-MessageDirectionality: Incoming\nX-MS-PublicTrafficType: Email\nX-MS-TrafficTypeDiagnostic:\n DM6NAM10FT094:EE_|CPWPR80MB6141:EE_|SCZPR80MB6981:EE_\nX-MS-Exchange-Organization-AuthSource:\n DM6NAM10FT094.eop-nam10.prod.protection.outlook.com\nX-MS-Exchange-Organization-AuthAs: Anonymous\nX-MS-Office365-Filtering-Correlation-Id: e510d1e0-8d30-4dd0-b95c-08db3a03892b\nX-MS-Exchange-EOPDirect: true\nX-Sender-IP: 192.252.146.28\nX-SID-PRA: JOHNSMITH@ICDTEST.NET\nX-SID-Result: PASS\nX-MS-Exchange-Organization-SCL: 1\nX-Microsoft-Antispam: BCL:0;\nX-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Apr 2023 20:38:26.1995\n (UTC)\nX-MS-Exchange-CrossTenant-Network-Message-Id: e510d1e0-8d30-4dd0-b95c-08db3a03892b\nX-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa\nX-MS-Exchange-CrossTenant-AuthSource:\n DM6NAM10FT094.eop-nam10.prod.protection.outlook.com\nX-MS-Exchange-CrossTenant-AuthAs: Anonymous\nX-MS-Exchange-CrossTenant-FromEntityHeader: Internet\nX-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:\n 00000000-0000-0000-0000-000000000000\nX-MS-Exchange-Transport-CrossTenantHeadersStamped: CPWPR80MB6141\nX-MS-Exchange-Transport-EndToEndLatency: 00:00:03.0105348\nX-MS-Exchange-Processed-By-BccFoldering: 15.20.6277.038\nX-Microsoft-Antispam-Mailbox-Delivery:\n\tabwl:0;wl:0;pcwl:0;kl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;auth:1;dest:I;ENG:(5062000305)(90000117)(90012020)(91020020)(91040095)(9050020)(9100338)(2008001134)(4810010)(4910033)(8820095)(9575002)(10195002)(9320005);\nX-Message-Info:\n\tqZelhIiYnPkx84CNH6AeQs2r1mfbx475RiI5K0+Xb2fvrntBfTJ10N2zNIvcvtf7VgXmo\/rIiDQIXO6S3rtSdn\/H4xrzDv+I2RFpBW+pxB4yhwf8VqBxAb2oTJ+jKAPjknpLKx0rGhWF\/Oowozp6RA==\nX-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MTtHRD0xO1NDTD0z\nX-Microsoft-Antispam-Message-Info:\n\t2XW49YUfX7Ef7WxmE6wjxj\/fif+7fGH+twWXcfxQtR1vkKoi4TjYoV1cO+qhBcvp1abvYKtlHlmCQF0GP91JLj+JBe1smkhgc7MbdZnC61tH+tK8px9bwLvfV7+VA3tXaSid7Z399I1Cse4j5wGp\/y6Q1UiBTB9I2WOWnXTD5+p6T4ih4Nj+IdT+qn7bEwtACvEqwT4MwMUXWE+9fSgWKULnwirt1jSJ4FcCLshMUYi5oo4+2J\/QiKtAa5LgXiINr9RYkNlPQZr2wMm6Y9jOSDOSpBFXskFYA53Vz91nHIIJ2tjCSsnlEhoMOxzdNqGafUWqDexnwzEgKcw8riXh\/V1g3Qpsm0aJn5Cw01BVdpZkI38fi1I36ymThNRZCzRTPLJlIzdd3eiWBi8qYFWS2DIlp1eLsMebuUP2U89bB9MedvQqpxTTn3Vn\/qXl4RTEPBfo+Jl6Mht8yGrS+Sw8CrMhf8M8H9d6Q3uRsP0MqLxRm4yKNMNDdVB2LOXuzZ1tm1wdmPE2jejJxp2dcZfBRwaio\/xNvKWFGHRGFHCkMXACrSMkC38UoguA4sVm1CyCiI7QuyPMbhqpXbTyM1vbRWQ4tGhcxnM995gwQ6S5oF7SovLiNlD4Mm0Wnf5z2R+WUFJxyRKrb2Kng+AbDGcAYrsV506J8dBL5kQDhOQC7ASlsUMKD5iQn\/\/dTpUMI\/0eJJniDQTNG45mPBQ0RUErwTN+CxLMHruIZyRiVPjWfqaqM2XnBctXIOsEEnnowIuyJpyndbpawHoA2IEk6SmJDRThlZsx2EzJrBDx5KA91hO5G4DDCDpYyL6o0yutK6nVFlJVbtns7q8XAFzEa5ENiQ==\n<strong>MIME-Version<\/strong>: 1.0<\/code><\/pre>\n\n\n\n<p>The main headers show some basic information:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>From<\/strong>: John Smith ICDSoft &lt;johnsmith@icdtest.net&gt;<\/li>\n\n\n\n<li><strong>To<\/strong>: icdsoft@hotmail.com<\/li>\n\n\n\n<li><strong>Subject<\/strong>: Test<\/li>\n\n\n\n<li><strong>Date<\/strong>: Mon, 10 Apr 2023 23:38:22 +0300<\/li>\n\n\n\n<li><strong>Return-Path<\/strong>: johnsmith@icdtest.net<\/li>\n<\/ul>\n\n\n\n<p>We can find interesting information about this message from some additional email headers:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>User-Agent<\/strong>: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko\/20100101  Thunderbird\/102.6.1<br><br><em>The message was sent via the email program called \"Mozilla Thunderbird\"<\/em><br><\/li>\n\n\n\n<li><strong>Received<\/strong>: from unknown (HELO ?213.145.98.191?) (johnsmith@icdtest.net@<strong>213.145.98.191<\/strong>) by s466.sureserver.com with ESMTPA; 10 Apr 2023 20:38:25 -0000<br><br><em>The message originates from s466.sureserver.com and was sent using SMTP authentication through mailbox johnsmith@icdtest.net<\/em> <em>from a device with IP address 213.145.98.191<\/em><br><\/li>\n\n\n\n<li><strong>Received<\/strong>: from s466.sureserver.com (<strong>192.252.146.28<\/strong>) by  DM6NAM10FT094.mail.protection.outlook.com (10.13.153.58) with Microsoft SMTP  Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id  15.20.6298.26 via Frontend Transport; Mon, 10 Apr 2023 20:38:26 +0000<br><br><em>The IP address of the sending mail server is <\/em><strong><em>192.252.146.28<\/em><\/strong><br><\/li>\n\n\n\n<li><strong>Authentication-Results<\/strong>: spf=pass (sender IP is 192.252.146.28)  smtp.mailfrom=icdtest.net; dkim=pass (signature was verified)  header.d=icdtest.net;dmarc=bestguesspass action=none  header.from=icdtest.net;compauth=pass reason=109<br><br><em>The SPF and DKIM checks passed, and the message has been verified as legitimate. The part \"<strong>dmarc=bestguesspass<\/strong> <strong>action=none<\/strong>\" means that the message is authenticated, but the matching authenticated domain is missing a DMARC record. Authenticated messages which pass the SPF\/DKIM checks and have SPF, DKIM, and DMARC records would have \"<strong>dmarc=pass action=none<\/strong>\" instead (if the DMARC entry is using the \"none\" policy). Spam emails would have something like \"<strong>dmarc=fail action=quarantine<\/strong>\" (if the DMARC entry is using the \"quarantine\" policy).<\/em><\/li>\n<\/ul>\n\n\n\n<p>Here is another example - a message sent from johnsmith@icdtest.net to gmail@icdtest.net, and then forwarded to icdsoft3@yahoo.com:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><strong>Received<\/strong>: from 10.197.34.204\n by atlas116.free.mail.bf1.yahoo.com pod-id NONE with HTTPS; Fri, 28 Apr 2023 15:12:41 +0000\n<strong>Return-Path<\/strong>: &lt;SRS1-LNPzUwy8=s466.sureserver.com=-dYsHhaIs=AT=icdtest.net=johnsmith@s807.sureserver.com&gt;\n<strong>X-Originating-Ip<\/strong>: &#91;195.8.222.25]\n<strong>Received-SPF<\/strong>: pass (domain of s807.sureserver.com designates 195.8.222.25 as permitted sender)\n<strong>Authentication-Results<\/strong>: atlas116.free.mail.bf1.yahoo.com;\n dkim=perm_fail header.i=@icdtest.net header.s=dkim;\n dkim=pass header.i=@icdtest.net header.s=dkim;\n spf=pass smtp.mailfrom=s807.sureserver.com;\n dmarc=pass(p=QUARANTINE) header.from=icdtest.net;\nX-Apparently-To: icdsoft3@yahoo.com; Fri, 28 Apr 2023 15:12:41 +0000\nX-YMailAVSC: lF3DrzU3bBu0FPN6dthhAHxeo9QUblJEBPOplMaK4eHqTNQ\n hXElN1TqInUx5XNgKv1R5J57VSg.5z5OP5Jm7n824cXEA9bHYs07gSt11sTH\n qf2OO34xrz03_Ry2vl8nOdQd84K8ZO03UBcfIEX4QsV7VdgbSDaMeIwMNSvR\n _dhveNFa0gqual8NoElmRv5F2ykyx_dziMmje_xv7_persOxcqHL12q3gAF8\n Vo9nZJ6I2H1nldPiS0wZa3szvxi8.MDMrJ41ft5bPIXiaag4crF.R4mvWrQ0\n 4_xh2EbgQ5Y5wqroXM9rn.KPlS_6omJ0lOpMTRB2K9FrTOxEq2mSTz7ZYomN\n 7O2L0ZvymvmeDl5VWjbVfDIO8Uig_1Cx1z24bCebm6nVfszuqfTKmUViz3Yu\n eyAFFBO4vXQ0PCq3RTTkKIui2J.MaXkhdf_amcruR07oqU8_tgHKZ1Ypldet\n ECgsvdp4wWXziyxn7.kZUF0wB7dHdURUKBa18YVOr56l05lDJLengpb3FB4t\n GGceVeaPzW9nz3SOMBtiRBGixCIVkdt5ncmw6gq0BQ5v0CqKU57XDxSBk_RN\n K36vfIobf1qKsjNGzRX0JTEOnvssqxw9ysxyPR5jQZmZ2mPKN06dP05jhVKu\n LxLT5jg469NNVnw2cvVaxJqEhEwbYQE6QMdYDfkolqerWqWv8pmEVA9VineX\n Dm3SIwYjh5IvfGdzDdrOMowDooQfyi2xayCKIVop7EHa0.9dYmqG95Q.tg0n\n pT7SY6cgM8dL14DAORl7NXGLviMXO6KPiOeKMkfK_.CQjO9O2BR5XNyCvWZl\n uZs0_Vk4rmKEyFGpoIN_Jp2un.my4J6YqjMz3tW10Ixp9G0xEoDC9G7H0sFF\n 3AQ1HkzEu3Xb79gpErBn6YyACXyjKbd9dDUiKX1zfk115Jf58zVdkiMmid0A\n jEc.cGdUgRemH6ei6o7XVFH54B7sLvPvKY7.B1EMO_QSqgpMxKo5ERRFsqRm\n yFxMaCM2aECQeSOq_rUXQDizzVXQiK4z2AD.Okt.40jZ4sD8dUktUZIr2EIo\n C.fVVoAtQq4wYPgoobQZgldwnfsVDgJOAq5QQbabj7ovBGLRoRfaeHUVfs8Q\n c6yiFb5nTgh_GwPmvd.9Kdp5m5rUuVqTjq_t0SB94gC7PfOvuLTimSVaQ_WA\n fDoTEpUu07RMSIwtwvoyYhGRP7vcr9O4mUt5qYhVsG4EItA--\nX-YMailISG: 4az9ipwWLDsebazowrhLLkN2KLfEgrpylAoDv0Cd37ObwwjK\n RMwMg3YDSz.6_m5b4n9TMm5liTJB8bk.yi56t446kr2H5lxjWT7FBOzSx6Ur\n zGezZuDbXHf2B1l7gDz.X1ty9SoPcm637vrBHcKnSkktGfRsocaSKcLKAxqu\n sP1K.TIHSHLqLZLdwP626GLbywnzLw0vYel.eW55jaAwo7.dG6pSnKgHHMuw\n VCGno3yiEVhyESX7s4IuYCQBTmRGSsWoKQUdMQOxsOuOH9L9POKXk2.9voTc\n VPrFttkSl7.wTsWEiQ5uChgLG1Xm.0cd1e3ea_LbDKoe.PQuqKTAyW6wFrJ2\n KCu6CYIAsX8fmQADrvDhFAXE3fqTwH_oxh2byb03sXr315yeMDU79B9FWExn\n EqLCT7aJFegmFhLpWzyBIyBF.iwJeObspLDN8IQLbIsZv1lbAx8rJblYV2z1\n hqvuiaE9w7HUo5tfFIYS3H5KexsygT.jfCqryDSqAdro6HXLvQriyzNyisjd\n kBEQ99wFLsMHamg.yoKTaqhh.aqJQZehFwZX07v9fzF5w.bnaK._Kiiuwwk9\n S3v.RXdmHd4uRVKC2JyRcauDodXE7WSxiA6EYcxcUa3zO.iDyAIgAy2UuDPN\n g5rLHtyIb19Fza812pUDO6Vt1b2_k2vyhoBysNsq29b8yKz5eMlr7Mt2aWT_\n h8YrNRUPa8BEkA3uXdVJ3DqTBzX0nHRiFwkdFGSdZaq0NZf8bZg4Y._2rdu1\n 1hHWkGoMk3n1sInrKsKQgGZUz1_Ut5nldr6hsSaFGEshSIN0o3_gSUNUv6sn\n zp88QvNnoB2ANToUs2hB2KSPKx53CPuHRWhIz2LDPul.SOj9jE2AUY.KGU17\n ImxGpQKd6WPzU_ue9hK9.qIh5k..ESZyx4wOGi._6IsNTOQ42T7WybDNdTRP\n 8s1rjOjP8ZibzHeLniMMxo8FhykqRMOGCd5EQD.Ced0Mq8djFxOw4YkkauIW\n oybO68ytasCmX_olsBOKykV6enAnqFZsPKBQi3_XBIlpghqV8geLjarLt4S2\n 0sLzlYWx0AdgxN6UE60KXpJwFgQfUoBMOeDq.hbZ66h6TLLmHpUPXLoQDoUe\n W7xucUhLK4buh927.rzLwFsYt10C.WBdsjYUINTniReUWMCLyb_jpsbr02v4\n jvOY1m3ZRmVPAkkXi3T.B4D3fl8DF7nKCurgk_zk6a..tUi0GvqgGW2cEE1G\n 92KdkJAimPxk9K1P269dA_FzFklD16TI8yMQhFAKVOzl1v4aWWlW8QLW9uZ8\n M2.Z\n<strong>Received<\/strong>: from 195.8.222.25 (EHLO s807.sureserver.com)\n by 10.197.34.204 with SMTPs\n (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256);\n Fri, 28 Apr 2023 15:12:41 +0000\n<strong>DKIM-Signature<\/strong>: v=1; a=rsa-sha256; c=relaxed; d=icdtest.net; h=\n\tmessage-id:date:mime-version:from:subject:to:content-type\n\t:content-transfer-encoding; s=dkim; bh=a+6z9N9M4Z1sFKIixisE8eG5o\n\tsnzDYVSQob1aq6RKk8=; b=AO4HL7+LxttUHcalSW9vTkbWz3bzefdJRUO9Wzzhv\n\tss9XXmkk3WwuaB7iSwzHflyIfKfd8RSeBSIh38l3EB26Z+zGAZFx2C9F93YmyHRX\n\trrr\/3Lv2zL7bn03sMNZer6Iusu\/up\/V+wIdYZqKcKUOZJC4mGMhJjQJ4lId9TZ40\n\tt8=\n<strong>Received<\/strong>: (qmail 20491 invoked by uid 1002); 28 Apr 2023 15:12:39 -0000\n<strong>Received<\/strong>: (qmail 20465 invoked by uid 1002); 28 Apr 2023 15:12:38 -0000\n<strong>Received<\/strong>: from s466.sureserver.com (192.252.146.28)\n  by s807.sureserver.com with SMTP; 28 Apr 2023 15:12:38 -0000\n<strong>DKIM-Signature<\/strong>: v=1; a=rsa-sha256; c=relaxed; d=icdtest.net; h=\n\tmessage-id:date:mime-version:from:subject:to:content-type\n\t:content-transfer-encoding; s=dkim; bh=a+6z9N9M4Z1sFKIixisE8eG5o\n\tsnzDYVSQob1aq6RKk8=; b=M3l4kKN4prAHvtqIan3+dx+f4JDcuKUqltzOtZQiD\n\tQBvBKM6ueBUDhN9tqNpIyhWi\/b0fcN9W+PAUZAS2UF\/aoTW1uQxjwdZ9SrQJvEPo\n\t8Fd5LMF4FKtAPsBp9LH26hOZo0MVP2NcyCRRqk5HyGmtJTH+pWiLpjcN0orhuNDw\n\ta0=\n<strong>Received<\/strong>: (qmail 53050 invoked by uid 1003); 28 Apr 2023 15:12:36 -0000\n<strong>Received<\/strong>: (qmail 53025 invoked by uid 1003); 28 Apr 2023 15:12:36 -0000\n<strong>Received<\/strong>: from unknown (HELO ?94.155.37.245?) (johnsmith@icdtest.net@94.155.37.245)\n  by s466.sureserver.com with ESMTPA; 28 Apr 2023 15:12:36 -0000\n<strong>Message-ID<\/strong>: &lt;405bba9e-37e6-928c-43fd-79f93cd9fd8f@icdtest.net&gt;\n<strong>Date<\/strong>: Fri, 28 Apr 2023 18:12:34 +0300\n<strong>MIME-Version<\/strong>: 1.0\n<strong>User-Agent<\/strong>: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko\/20100101\n Thunderbird\/102.6.1\n<strong>From<\/strong>: John Smith ICDSoft &lt;johnsmith@icdtest.net&gt;\n<strong>Subject<\/strong>: Forwarding test\n<strong>To<\/strong>: gmail@icdtest.net\nContent-Language: bg, en-US\nContent-Type: text\/plain; charset=UTF-8; format=flowed\nContent-Transfer-Encoding: 7bit\n<strong>Delivered-To<\/strong>: icdtest.net-gmail@icdtest.net\n<strong>Delivered-To<\/strong>: icdtestdomain.com-postmaster@icdtestdomain.com\nContent-Length: 32\n\nThis email will be forwarded.\n<\/code><\/pre>\n\n\n\n<p>Some email headers stand out:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Delivered-To<\/strong>: icdtest.net-gmail@icdtest.net<br><strong>Delivered-To<\/strong>: icdtestdomain.com-postmaster@icdtestdomain.com<br><br>Two Delivered-To headers. This shows that the message was first delivered to gmail@icdtest.net,  then to postmaster@icdtestdomain.com, and finally to icdsoft3@yahoo.com.<br><\/li>\n\n\n\n<li><strong>Received<\/strong>: from 10.197.34.204  by atlas116.free.mail.bf1.yahoo.com pod-id NONE with HTTPS; Fri, 28 Apr 2023 15:12:41 +0000<br><strong>Received<\/strong>: from 195.8.222.25 (EHLO s807.sureserver.com) by 10.197.34.204 with SMTPs (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256); Fri, 28 Apr 2023 15:12:41 +0000<br><strong>Received<\/strong>: from s466.sureserver.com (192.252.146.28) by s807.sureserver.com with SMTP; 28 Apr 2023 15:12:38 -0000<br><strong>Received<\/strong>: from unknown (HELO ?94.155.37.245?) (johnsmith@icdtest.net@94.155.37.245) by s466.sureserver.com with ESMTPA; 28 Apr 2023 15:12:36 -0000<br><br>These lines show the route of the message and are best read from the bottom to the top. The message was first sent from johnsmith@icdtest.net via s466.sureserver.com, then it was delivered to s807.sureserver.com, after which it was forwarded and received at Yahoo. <br><\/li>\n\n\n\n<li><strong>Return-Path<\/strong>: &lt;SRS1-LNPzUwy8=s466.sureserver.com=-dYsHhaIs=AT=icdtest.net=johnsmith@s807.sureserver.com><br><br>The Return-Path header of the message forwarded to Yahoo is modified by the forwarding server via the <a href=\"http:\/\/www.open-spf.org\/SRS\/\" target=\"_blank\" rel=\"noreferrer noopener\">Sender Rewriting Scheme<\/a> (SRS). This improves the deliverability of forwarded emails, because the SPF configuration of the matching authenticated domain lists the server's IP address as permitted sender. This way, messages sent on behalf of icdtest.net (forwarded emails) through a third-party server (s807.sureserver.com) pass the SPF check. The SRS works backwards as well, so replies to the SRS address will still reach the original sender. In this case, if a reply is sent back to <strong>SRS1-LNPzUwy8=s466.sureserver.com=-dYsHhaIs=AT=icdtest.net=johnsmith@s807.sureserver.com<\/strong>, this address will be transformed to johnsmith@icdtest.net on our end, and the reply will be delivered there. Many email service providers have not introduced SRS (Sender Rewriting Scheme) yet, and these providers suffer from increased rates of email delivery issues, particularly when it comes to forwarding emails. Without SRS, forwarded emails often fail SPF (Sender Policy Framework) checks because the original sender's IP address does not match the forwarding server's IP address. This mismatch can lead to legitimate emails being marked as spam or outright rejected by receiving email servers, significantly impacting email deliverability and sender reputation.<br><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"in-conclusion-1437624e-4658-4726-883b-a66bb074811f\">In Conclusion<\/h2>\n\n\n\n<p>Email headers can be very useful to trace an email - from the originating server to the final recipient. The headers also show important information regarding the authenticity of the message. Learning more about email headers could also protect you against spam and phishing emails, because spammers often send spoofed messages which only appear as sent from a known entity, but are actually sent via compromised servers and email systems.<\/p>\n\n\n\n<p>If email headers still seem confusing, it is because they are. At ICDSoft, we have a team of experienced support persons, who can help you decipher the email headers, just post a ticket through our support systems.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>What are email headers? Email headers contain valuable information about the path of the message from its initial sender to the final recipient. This includes IP addresses, server names, authentication data, originating entity to mention a few. This part of the email is usually hidden and can be analyzed by viewing the source code of<\/p>\n","protected":false},"author":1,"featured_media":11917,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-11797","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-general"},"author_meta":{"display_name":"ICDSoft","author_link":"https:\/\/www.icdsoft.com\/blog\/author\/icdsoft\/"},"featured_img":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/EmailHeadersFeatured-300x150.png","featured_image_src":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/EmailHeadersFeatured.png","featured_image_src_square":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/04\/EmailHeadersFeatured.png","author_info":{"display_name":"ICDSoft","author_link":"https:\/\/www.icdsoft.com\/blog\/author\/icdsoft\/"},"coauthors":[],"tax_additional":{"categories":{"linked":["<a href=\"https:\/\/www.icdsoft.com\/blog\/category\/general\/\" class=\"advgb-post-tax-term\">General<\/a>"],"unlinked":["<span class=\"advgb-post-tax-term\">General<\/span>"]}},"comment_count":"0","relative_dates":{"created":"Posted 3 years ago","modified":"Updated 2 years ago"},"absolute_dates":{"created":"Posted on May 5, 2023","modified":"Updated on February 29, 2024"},"absolute_dates_time":{"created":"Posted on May 5, 2023 10:34 am","modified":"Updated on February 29, 2024 12:35 pm"},"featured_img_caption":"","series_order":"","_links":{"self":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11797","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/comments?post=11797"}],"version-history":[{"count":19,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11797\/revisions"}],"predecessor-version":[{"id":12929,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11797\/revisions\/12929"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/media\/11917"}],"wp:attachment":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/media?parent=11797"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/categories?post=11797"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/tags?post=11797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}