Meaning
Technical identifiers at the top of an email transmission contain the path the message took from the sender to the recipient. These text blocks record the address of every mail server that handled the message and the time it arrived at each hop. By reading smtp headers, an investigator can verify the true origin of an email and detect if the sender information was falsified.
The header stops at the final delivery agent where the message is placed in the recipient’s mailbox.
Routing Chain
Each server along the route adds a received line that includes its own identity and a timestamp. An analysis of smtp headers can show if an email was delayed by a specific gateway or if it passed through a server in an unexpected jurisdiction. This data provides a level of proof about the timing and source of a communication that the body of the email does not contain.
Forgery Detection
Authentication records like DKIM and SPF are also found within these headers to prove the message was not altered in transit. Discrepancies between these records and the claiming sender in the smtp headers suggest the email is a spoof or a forgery.
Header Length
Raw headers are typically hidden by default in most email clients.
