Analyse header mail

A header analysis!

When analyzing a mail header, we're looking at the metadata that accompanies an email message. The header contains information about the sender, recipient, date, time, and other details about the email's journey from sender to recipient. Here's a breakdown of the different parts of a typical email header:

From: The sender's email address.

To: The recipient's email address.

Subject: The subject line of the email.

Date: The date and time the email was sent.

Message-ID: A unique identifier assigned to the email by the sending mail server.

Received: A series of lines that show the path the email took from the sender to the recipient, including the IP addresses and mail servers involved.

Sender: The email address of the person who sent the email (may be different from the From field).

Reply-To: The email address to which replies should be sent.

Return-Path: The email address to which bounces and errors should be sent.

X- headers: Custom headers added by the sender or mail server, which can contain additional information such as spam scores or virus scans.

Here's an example of a simple email header:

From: [email protected]
To: [email protected]
Subject: Test email
Date: Wed, 12 Jan 2022 14:30:00 +0000
Message-ID: <[email protected]>
Received: from mail.example.com (mail.example.com [192.0.2.1])
    by mx.example.com (mx.example.com [192.0.2.2]) with SMTP id 1234567890;
    Wed, 12 Jan 2022 14:30:00 +0000
Sender: [email protected]
Reply-To: [email protected]
Return-Path: [email protected]
X-Spam-Score: 0.0
X-Virus-Scanned: Clean

Now, let's analyze this header:

• The email was sent from [email protected] to [email protected].
• The subject line is "Test email".
• The email was sent on January 12, 2022, at 14:30:00 UTC.
• The Message-ID is a unique identifier assigned by the sending mail server.
• The Received lines show the path the email took from the sender to the recipient, including the IP addresses and mail servers involved.
• The Sender and Reply-To fields are the same, indicating that replies should be sent to the same email address.
• The Return-Path field is the same as the Sender field, indicating that bounces and errors should be sent to the same email address.
• The X-Spam-Score and X-Virus-Scanned headers indicate that the email was scanned for spam and viruses, and was deemed clean.

This is just a basic analysis, but headers can contain much more information, such as:

• Authentication results (e.g., SPF, DKIM, DMARC)
• Encryption information (e.g., PGP, S/MIME)
• Tracking information (e.g., open and click tracking)
• Spam and virus scanning results
• Custom headers added by the sender or mail server

By analyzing the header, you can gain insights into the email's origin, routing, and content, which can be useful for troubleshooting, security, and compliance purposes.