Understanding an email header

Most of the time, it may seem that email has been sent directly from the sender to the recipient; however, this is not necessarily true, since a “standard” email passes through at least four servers or computers.

To get started, you will need to find the complete email header of the email you want to review.

View email headers

In the following example, the “Sender” remitente@ejemplo.com wants to send an email to the “Recipient” destinatario@ejemplo2.com.

The sender created the email at ejemplo.com, and destinatario@ejemplo2.com received it in the Apple Mail email client.

Cabeceras de correo
From: Remitente de ejemplo (remitente@ejemplo.com)
Subject: Esto es un correo de ejemplo
Date: December 07, 2012 4:30:58 PM PDT
To: destinatario@ejemplo2.com
Return-Path: <remitente@ejemplo.com>
Envelope-To: destinatario@ejemplo2.com
Delivery-Date: Fri, 07 Dec 2012 16:31:01 -0700
Received: from smtp.ejemplo.com ([xxx.xxx.xxx.xxx]:54907) by servidor.ejemplo3.com with esmtp (Exim 4.63) (envelope-from <remitente@ejemplo.com>) id 1RSdDH-0000f0-RL for destinatario@ejemplo2.com; Fri, 07 Dec 2012 16:31:01 -0700
Received: by smtp.ejemplo.com with SMTP id ysd84791346pof.4 for <destinatario@ejemplo2.com>; Fri, 07 Dec 2012 16:31:01 -0700 (PDT)
Received: by xx1.xx1.xx1.xx1 with SMTP id t17ms8469566rvm.251.1758482398741; Fri, 07 Dec 2012 16:30:58 -0700 (PDT)
Received: by xx2.xx2.xx2.xx2 with HTTP; Fri, 07 Dec 2012 16:30:58 -0700 (PDT)
Message-Id: <c8f49cec1547854973k11196ad4p7cb4b9420f2ae752@mail.ejemplo.com>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary=”—-=_Part_3927_75481698.2459837458678″
X-Spam-Status: score=3.7 tests=DNS_FROM_RFC_POST, HTML_00_10, HTML_MESSAGE, HTML_SHORT_LENGTH version=3.1.7
X-Spam-Level: ***
Message Body: Este correo es un ejemplo para poder explicar las cabeceras de correo.

Understanding email headers

• From – This shows who the message is from; however, this line can be easily modified and would be the least trustworthy.
• Subject – This is what the sender enters as the topic of the email's content, commonly known as the “Subject”.
• Date – This line shows the date and time when the message was composed.
• To – This shows who the message was addressed to, but it might not contain the recipient's address.
• Return-Path – The email account for returning the email. This is the same as “Reply-To:”.
• Envelope-To – This header shows that this email was sent to the subscriber's mailbox whose email account is destinatario@ejemplo2.com.
• Delivery Date – This shows the date and time when the email was received by your email service or client.
• Received – This header is the most important and usually the most trustworthy. It shows a list of all the servers / computers the email passed through to reach the recipient.The “received” lines are best read from bottom to top. That is, the first “Received:” line is your own system or mail server. The last “Received:” line is where the email originated. Each email system has its own style for displaying the lines. "Received:”. A typical “Received:” line identifies the machine receiving the email and the machine from which the email was received.
• Message-id – A unique string assigned by the email system when the message is created. This can be easily forged.
• Mime-Version – Multipurpose Internet Mail Extensions (MIME) is an internet standard that extends the format of email. For more details, you can consult http://es.wikipedia.org/wiki/Multipurpose_Internet_Mail_Extensions.
• Content-Type – Generally, this line indicates the message format, such as html or plain text.
• X-Spam-Status – This shows the Spam score generated by your email service or client.
• X-Spam-Level – This shows the Spam score usually generated by your email service or client.
• Message Body – The content of the email itself, written by the sender.