Options:

Mail Header Results

Return-Path

The 'Return-Path' field is contained in the envelope header so it is generally not visible when viewing an email, although it contains the only reliable information about the originator's true address (i.e., the fully qualified domain name of the originator's email account). Since the 'Return-Path' is added by the first receiving MTA in the host-to-host delivery chain, it cannot be forged.

In contrast, the 'From' and 'Reply-To' fields can be set to any value. Mailing lists commonly specify values for the 'From' and 'Reply-To' fields is commonly used by as an integral part of the automated bounce handling process (so that when a mailing list message bounces, the bounce message won't be posted to the list and forwarded to every subscriber on the mailing list). This technique is also commonly used by spammers to obscure their identity, so some spam filters check to see if the values in the 'From' and 'Reply-To' fields match the value in the 'Return-Path'. If they don't match, they are deleted, which is why mailing list email sometimes disappear in route. Since this approach to spam detection is so error prone, its use is deprecated.

The Examine Email Headers tool doesn't display the 'Reply-To' field, but you can find it by viewing the source in your MUA if you wish.

The originator's IP address is nice to have if you want to add a spammer to a blocklist or report them to their ISP or a spam abuse organization.

For more information, see Analyzing Email.

From

The contents of the message header's 'From' field. This field is set by the sender's computer, so it doesn't necessarily reveal the identity of the sender, although it may. Email distributed by mailing lists generally use an alias in the 'From' field so the sender's private email address isn't broadcast.

To

The contents of the message header's 'To' field. This is the email address to which the email was sent. If it does not match the receiver's email address, then it may have been sent to an alias or mailing list to which the receiver is subscribed, or the receiver may have been CC'd or BCC'd on the email.

CC

The contents of the message header's 'CC' field. This field is available to users sending email from Kavi® Groups regarding document sharing or calendar events. It also sometimes explains why an individual who is not a member of the organization mysteriously received an organization email: they were CC'd on the email by someone who is a member.

Date

The message header's 'Date' field. This should be the date the email was sent (unless the email client's computer has the wrong date).

Subject

The contents of the message header's 'Subject' field. If this email is from a list, the name of the list may appear at the beginning of the subject line. If the subject line was blank before being forwarded, it may explain why the email never made it to the intended recipient: it was eaten by a spam filter.

Delivery Path and Times

The information will look something like this:

Wed, 10 Nov 2004 08:19:42 -0000

00:00 00:00 localhost -> server1.example.org

00:00 00:14 server1.example.org -> server2.example.com

Wed, 10 Nov 2004 08:05:12 -0000

This is the simplest possible example: an email sent directly from the originating host (generally a user's computer or, if this is an automated email, the computer hosting the web site) to a host at the originator's ISP (probably a mail server), to a host at the receiver's ISP (another mail server). If this email had passed through other hosts, the central lines would be repeated for every leg of the host-to-host journey that the email passed through during the delivery process.

• The first line in the delivery path indicates the date and time that the email originated according to the originating host's time clock. The time is based on a twenty-four hour clock (i.e., ANSI or military time), normalized to Universal Time.

• The last line in the delivery path indicates the date and time that the email arrived at the receiving host, according to the receiving host's time clock.

• Each of the lines between the first and last represents one leg of the host-to-host journey through which the email passed.

  The date and time values display elapsed time, rather than real time, so the first time value is set to zero (i.e., '00:00') as it would be on a stopwatch before you began timing an event. The second time value indicates the time it took to complete the transfer (the point at which you would click the stopwatch).

  The second line of the example represents the transfer from the originating host to the originator's mail server. In this case, the email originated through a mailing list and was sent to a local mail host at the organization, so it appears as though no time elapsed during the first host-to-host transfer. In reality, it may have taken less than a second. The third line shows the transfer of the email from the organization's mail server to the destination host, a mail server at a member company. Again, the initial timestamp is set to '00:00', but this time the second timestamp is set to '00:14', indicating it took 14 minutes to complete the transfer to the destination host.

• Following the set of time values, each middle line displays the hostname or IP address of the sending host and receiving host for that leg of the transfer process. When an IP address is displayed instead of a hostname, it may indicate a mail server was unable to resolve the hostname that was provided to it and substituted the actual IP address of the sending mail server—possibly because the domain name was forged to hide the true IP of the email's originator.