Email Header Analysis — Reading the Metadata Correctly

What lives in the header

The visible part of an email is the smaller one. The head of every message carries dozens of fields documenting the path from sender to recipient, revealing the software involved, and forming the basis of any forensic analysis. Anyone wanting to know why a message landed in spam, or whether it is genuine, will almost always find the answer here.

What AnalyzeMy.Email checks

• Message-ID — present, syntactically valid and with a plausible domain? A missing Message-ID is a clear sign of a home-grown sending script.
• Date — present, parseable and plausible? Dates from the future or the distant past are a known spam trick for sorting to the top of the inbox.
• MIME-Version — required for structured messages.
• Reply-To mismatch — does Reply-To point at a different domain than From? Legitimate for support systems, a strong warning sign on a supposed invoice.
• X-Mailer and User-Agent — the sending software. Known bulk-mailing scripts are recognized.
• Subject — irregularities such as all caps, clusters of exclamation marks, or typical spam patterns.
• Received chain — every hop is parsed and rendered as a routing path with per-leg TLS status.
• Raw headers — complete, with syntax highlighting for IPs, addresses, domains and timestamps.

Reading the Received chain

Received headers are read bottom to top: the lowest comes from the first server, the topmost from the last. Every server prepends its own entry. Crucially, only the entries from your own trusted gateway upwards are dependable. Everything below can be invented freely by the sender, who controls the start of the chain.

That is exactly why the sender IP is taken from the first Received header carrying a public IPv4 address, skipping private ranges — that is the last hop whose statement does not originate from the sender.

Common findings

• Missing Message-ID in hand-written sending scripts. Costs points with practically every filter.
• Wrong timezone — a server with an incorrect clock produces Date headers off by hours.
• Reply-To pointing at a freemail address on a message from a corporate domain — the classic CEO fraud pattern.
• Internal hostnames and IPs in Received headers, revealing more about your infrastructure than necessary.