{"id":5407,"date":"2021-05-12T11:36:44","date_gmt":"2021-05-12T11:36:44","guid":{"rendered":"https:\/\/chemicloud.com\/kb\/?post_type=ht_kb&#038;p=5407"},"modified":"2021-05-12T11:36:44","modified_gmt":"2021-05-12T11:36:44","slug":"understanding-an-email-header","status":"publish","type":"ht_kb","link":"https:\/\/chemicloud.com\/kb\/article\/understanding-an-email-header\/","title":{"rendered":"Understanding an Email Header"},"content":{"rendered":"<p>Sometimes when troubleshooting email delivery you will need to analyze the mail header to figure out what went wrong when you sent or received that message. We created this guide to help you understand what the contents of an email header mean.<\/p>\n<p>Let&#8217;s begin!<\/p>\n<h2 id=\"how-to-view-an-email-header\">How to view an Email Header<\/h2>\n<p>If you aren&#8217;t familiar with how to view an email header, review our Knowledgebase Article on the topic <a href=\"https:\/\/chemicloud.com\/kb\/article\/view-e-mail-message-headers\/\">here<\/a>.<\/p>\n<p>What&#8217;s an Email Header Look Like?<\/p>\n<p>Let&#8217;s take a look at the headers on this message I recently received from Cloudflare:<\/p>\n<pre>Return-Path: &lt;713-XSC-918.0.523679.0.0.47834.9.220102596@bounce.cloudflare.com&gt;\r\nDelivered-To: admin@cchostingdemos.com\r\nReceived: from rs2-dal.serverhostgroup.com\r\n\tby rs2-dal.serverhostgroup.com with LMTP\r\n\tid ABlRGJN+kWCfFAAArSgKyQ\r\n\t(envelope-from &lt;713-XSC-918.0.523679.0.0.47834.9.220102596@bounce.cloudflare.com&gt;)\r\n\tfor &lt;admin@cchostingdemos.com&gt;; Tue, 04 May 2021 13:04:19 -0400\r\nReturn-path: &lt;713-XSC-918.0.523679.0.0.47834.9.220102596@bounce.cloudflare.com&gt;\r\nEnvelope-to: admin@cchostingdemos.com\r\nDelivery-date: Tue, 04 May 2021 13:04:19 -0400\r\nReceived: from bounce.cloudflare.com ([192.28.154.211]:54889)\r\n\tby rs2-dal.serverhostgroup.com with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\r\n\t(Exim 4.94)\r\n\t(envelope-from &lt;713-XSC-918.0.523679.0.0.47834.9.220102596@bounce.cloudflare.com&gt;)\r\n\tid 1ldySt-0001O7-P9\r\n\tfor admin@cchostingdemos.com; Tue, 04 May 2021 13:04:19 -0400\r\nX-MSFBL: 6L1whzPBe2O1M048olaxQrdKp6aBuU0YeoW35BFNjh0=|eyJnIjoiYmctYWJkLTg\r\n\t0NCIsInIiOiJhZG1pbkBjY2hvc3RpbmdkZW1vcy5jb20iLCJiIjoiZHZwLTE5Mi0\r\n\tyOC0xNTQtMjExIiwidSI6IjcxMy1YU0MtOTE4OjA6Mzg1NTU6MzA1MzQ0Ojc5MjY\r\n\t1Njo0NzgzNDo5OjUyMzY3OToyMjAxMDI1OTYifQ==\r\nDKIM-Signature: v=1; a=rsa-sha256; q=dns\/txt; c=relaxed\/relaxed; t=1620147046;\r\n\ts=m1; d=cloudflare.com; i=@cloudflare.com;\r\n\th=Content-Type:MIME-Version:Subject:To:From:Date;\r\n\tbh=9+V8RW6CdzfUNkIQW13NlUs0bkYglkEFbfyw+sOKgqU=;\r\n\tb=NPdi1tqYkPC4q9I4XA67LcScLhrJb374W6zqGfc6ppasZjGj5TD9hho\/O2kfuztl\r\n\tr+57DIhzQ928o256pyMje7Y3MKHeMyNtCPYSDKGycs3OXre5fZbhdWihJo1NO6rE1aP\r\n\tzlhL47Q4WpmJq19LznC8gOu\/6WWmYayhfmT632QI=\r\nDKIM-Signature: v=1; a=rsa-sha256; q=dns\/txt; c=relaxed\/relaxed; t=1620147046;\r\n\ts=m1; d=mktdns.com; i=@mktdns.com;\r\n\th=Content-Type:MIME-Version:Subject:To:From:Date;\r\n\tbh=9+V8RW6CdzfUNkIQW13NlUs0bkYglkEFbfyw+sOKgqU=;\r\n\tb=XEryQBzICTRY\/D+UQYyeMT4\/Vy5p0QzHli0ldrUnEcFl3Loh03KBSkxHD+2pg9vu\r\n\tSGP+ZruN\/4AF2IVN5KvhjBJiLV02KWTR\/BQwhZmuSTSrN5hToMgWUL5sSrOSQ43BuzP\r\n\tKIRx9bBWgr7NNjHoUxABqLTQ\/QE47bTtyfo0NN\/A=\r\nDate: Tue, 4 May 2021 11:50:46 -0500 (CDT)\r\nFrom: Cloudflare &lt;newsletter@cloudflare.com&gt;\r\nReply-To: newsletter@cloudflare.com\r\nTo: admin@cchostingdemos.com\r\nMessage-ID: &lt;388175313.12477952.1620147046128@abmktmail-batch1e.marketo.org&gt;\r\nSubject: 5.41 MB of data transferred in    April\r\nMIME-Version: 1.0\r\nContent-Type: multipart\/alternative; \r\n\tboundary=\"----=_Part_12477951_36658994.1620147046127\"\r\nX-Binding: bg-abd-844\r\nList-Unsubscribe: &lt;mailto:NVBDA6K7IZ5GINLONM3G6VK2PBHGSTSINRDXQYSSJVBUUUTQGJWVQQKDORYFQT3UMZYXOPI=.523679.47834.9@unsub-ab.mktomail.com&gt;\r\nX-PVIQ: mkto-713XSC918-000001-000000-523679\r\nX-MarketoID: 713-XSC-918:0:38555:305344:792656:47834:9:523679:220102596\r\nX-Mailfrom: 713-XSC-918.0.523679.0.0.47834.9.220102596@bounce.cloudflare.com\r\nX-MktArchive: false\r\nX-MSYS-API: {\"options\":{\"open_tracking\":false,\"click_tracking\":false}}\r\nX-MktMailDKIM: true\r\nX-Spam-Status: No, score=-0.2\r\nX-Spam-Score: -1\r\nX-Spam-Bar: \/\r\nX-Ham-Report: Spam detection software, running on the system \"rs2-dal.serverhostgroup.com\",\r\n has NOT identified this incoming email as spam.  The original\r\n message has been attached to this so you can view it or label\r\n similar future email.  If you have any questions, see\r\n root\\@localhost for details.\r\n Content preview:  You can also view this email as a webpage &lt;[[https:\/\/info.cloudflare.com\/index.php\/email\/emailWebview?mkt_tok=NzEzLVhTQy05MTgAAAF810K22Dj-YRMGqmyLOV3MQgBYYP7lommWfZEn6cu5rDzE4cdkiXFsQrQGEsN6sk8rzdn7QI\r\n    [...] \r\n Content analysis details:   (-0.2 points, 5.0 required)\r\n  pts rule name              description\r\n ---- ---------------------- --------------------------------------------------\r\n  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was\r\n                             blocked.  See\r\n                             http:\/\/wiki.apache.org\/spamassassin\/DnsBlocklists#dnsbl-block\r\n                              for more information.\r\n                             [URIs: cloudflare.com]\r\n -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record\r\n -0.0 SPF_PASS               SPF: sender matches SPF record\r\n  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or\r\n                             identical to background\r\n  0.0 HTML_MESSAGE           BODY: HTML included in message\r\n -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from\r\n                             envelope-from domain\r\n -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature\r\n  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily\r\n                             valid\r\n -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from\r\n                             author's domain\r\n  0.0 T_KAM_HTML_FONT_INVALID Test for Invalidly Named or Formatted\r\n                             Colors in HTML\r\nX-Spam-Flag: NO\r\n\r\n------=_Part_12477951_36658994.1620147046127\r\nContent-Type: text\/plain; charset=UTF-8\r\nContent-Transfer-Encoding: quoted-printable<\/pre>\n<h2 id=\"how-to-analyze-an-email-header\" class=\"h3 u-textAllcaps\">How To Analyze an Email Header<\/h2>\n<div class=\"warning\">\n    \t\t<div class=\"hts-messages hts-messages--alert  hts-messages--withtitle hts-messages--withicon \"   >\r\n    \t\t\t<span class=\"hts-messages__title\">Important:<\/span>    \t\t\t    \t\t\t\t<p>\r\n    \t\t\t\t\tKeep in mind when reading an email header, EVERY LINE can be forged. So only the Received: lines that are created by the server or the computer should be trusted.     \t\t\t\t<\/p>\r\n    \t\t\t    \t\t\t\r\n    \t\t<\/div><!-- \/.ht-shortcodes-messages -->\r\n    \t\t\n<\/div>\n<h3 id=\"from\">From<\/h3>\n<ul>\n<li>This displays who sent the message, however, this can be easily forged and can be the least reliable.<\/li>\n<\/ul>\n<h3 id=\"subject\">Subject<\/h3>\n<ul>\n<li>This is what the sender placed as a topic of the email message.<\/li>\n<\/ul>\n<h3 id=\"date\">Date<\/h3>\n<ul>\n<li>This shows the date and time the email message was composed.<\/li>\n<\/ul>\n<h3 id=\"to\">To<\/h3>\n<ul>\n<li>This shows to whom the message was addressed, but may not contain the recipient&#8217;s address.<\/li>\n<\/ul>\n<h3 id=\"return-path\">Return-Path<\/h3>\n<ul>\n<li>The email address for return mail. This is the same as &#8220;Reply-To:&#8221;.<\/li>\n<\/ul>\n<h3 id=\"envelope-to\">Envelope-To<\/h3>\n<ul>\n<li>This header shows that this email was delivered to the mailbox of a subscriber whose email address is admin @ chcostingdemos . com.<\/li>\n<\/ul>\n<h3 id=\"delivery-date\">Delivery Date<\/h3>\n<ul>\n<li>This shows the date and time at which the email was received by your mail server or client.<\/li>\n<\/ul>\n<h3 id=\"received\">Received<\/h3>\n<ul>\n<li>The received is the most important part of the email header and is usually the most reliable. They form a list of all the servers\/computers through which the message traveled in order to reach you.<\/li>\n<li>The received lines are best read from bottom to top.\n<ul>\n<li>That is, the first &#8220;Received:&#8221; line is your own system or mail server.<\/li>\n<li>The last &#8220;Received:&#8221; line is where the mail originated.<\/li>\n<li>Each mail system has their own style of &#8220;Received:&#8221; line.<\/li>\n<li>A &#8220;Received:&#8221; line typically identifies the server that received the mail and the server from which the mail was received.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3 id=\"dkim-signature-domainkey-signature\">Dkim-Signature &amp; Domainkey-Signature<\/h3>\n<ul>\n<li>\u00a0This indicates if the domain key identifiers are validated to ensure that a server signed to this domain truly sent this message or not.<\/li>\n<\/ul>\n<h3 id=\"message-id\">Message-id<\/h3>\n<ul>\n<li>A unique string assigned by the mail system when the message is first created. These can easily be forged.<\/li>\n<\/ul>\n<h3 id=\"mime-version\">Mime-Version<\/h3>\n<ul>\n<li>Multipurpose Internet Mail Extensions (MIME) is an\u00a0<a href=\"http:\/\/en.wikipedia.org\/wiki\/Internet_standard\" rel=\"nofollow noopener\" target=\"_blank\">Internet standard<\/a>\u00a0that extends the format of\u00a0email. There are various MIME differentiators that could be attached, such as a S\/MIME which uses PGP signing to encrypt a message.<\/li>\n<\/ul>\n<h3 id=\"content-type\">Content-Type<\/h3>\n<ul>\n<li>Generally, this will tell you the format of the message, such as html or plaintext.<\/li>\n<\/ul>\n<h3 id=\"x-spam-status\">X-Spam-Status<\/h3>\n<ul>\n<li>Displays a spam score created by your service or mail client.<\/li>\n<\/ul>\n<h3 id=\"x-spam-level\">X-Spam-Level<\/h3>\n<ul>\n<li>Displays a spam score usually created by your service or mail client.<\/li>\n<\/ul>\n<h3 id=\"message-body\">Message Body<\/h3>\n<ul>\n<li>This is the actual content of the email itself, written by the sender.<\/li>\n<\/ul>\n<h2 id=\"finding-the-original-sender\" class=\"h3 u-textAllcaps\">Finding The Original Sender<\/h2>\n<p>The easiest way for finding the original sender is by looking for the\u00a0<strong>X-Originating-IP<\/strong> header.<\/p>\n<p>This header is important since it tells you the IP address of the computer that had sent the email.<\/p>\n<p>If you cannot find the\u00a0<strong>X-Originating-IP<\/strong>\u00a0header, then you will have to sift through the\u00a0<strong>Received<\/strong> headers to find the sender&#8217;s IP address. In the headers above, that IP address is 192.28.154.211.<\/p>\n<p>Once the email sender&#8217;s IP address is found, you can search for it at <b><a href=\"https:\/\/www.arin.net\" rel=\"nofollow noopener\" target=\"_blank\">ARIN<\/a>.<\/b><\/p>\n<p>You should now be given results letting you know to which ISP (Internet Service Provider) or webhost the IP address belongs. Now, if you are tracking a spam email, you can send a complaint to the owner of the originating IP address. Be sure to include all the headers of the email when filing a complaint.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sometimes when troubleshooting email delivery you will need to analyze the mail header to figure out what went wrong when you sent or received that message. We created this guide to help you understand what the contents of an email header mean. Let&#8217;s begin! How to view an Email Header&#8230;<\/p>\n","protected":false},"author":10,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"ht-kb-category":[31],"ht-kb-tag":[],"class_list":["post-5407","ht_kb","type-ht_kb","status-publish","format-standard","hentry","ht_kb_category-email-faqs"],"_links":{"self":[{"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb\/5407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/comments?post=5407"}],"version-history":[{"count":3,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb\/5407\/revisions"}],"predecessor-version":[{"id":5419,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb\/5407\/revisions\/5419"}],"wp:attachment":[{"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/media?parent=5407"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb-category?post=5407"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/chemicloud.com\/kb\/wp-json\/wp\/v2\/ht-kb-tag?post=5407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}