Analyzing Email Header

    Analyzing Email Header

In this article, I am going to introduce my followers that how to analyze the Email headers fields and understand the different- different portion information of Email header.

Before we start analyzing the email header field, we should know how to access or extract the email header in different - different emails clients.

1. How to access Email header in Gmail:

Login to your Gmail account & click on any email (which header you want to analyze).

Click on triangular button under the red circle and click on Show original.

                     Image-1.1

When you will click on show original, Email header will be open in a new window, copy that email header in any text or word file to analyze it.

2. How to access Email header in Yahoo.com

Login to Yahoomail

Click on More under the red box and then click on View full header to open the email header.

                                                Image-1.2

3. How to access the Email header in Hotmail

Login to your hotmail account

Click on any email, which header you want to access

Click on the red circle place and click on View message source

                                                Image- 1.3

4. Access the Email Header in Microsoft Outlook

Login in MS Outlook and double click on any email, which header you want to access

Click on triangular under the red circle box

See the Email header under the Internet header.

                                                Image-1.4

5. Access the Email header in Microsoft Outlook Express

Login in MS Outlook Express and click on email, which header you want to access

Right-click on it and select Properties and go to Details to see the header.

Analyzing the Email Header:

Here I am going to show you the original Email header and will explain the each part of message header.

MIME-Version: 1.0 Received: by 10.221.37.133 with HTTP; Sat, 23 Nov 2013 01:16:32 -0800 (PST) Date: Sat, 23 Nov 2013 14:46:32 +0530 Delivered-To: arunkalagarh@gmail.com Message-ID: <CAE-W5LJM8w88r9U9JZsw3Zb4cPWQZLEU0CeSwmMTmMgcwCF_5g@mail.gmail.com> Subject: docs From: Arun Chaudhary <arunkalagarh@gmail.com> To: Arun Chaudhary <arunkalagarh@gmail.com> X-Mailer: Mail Client Content-Type: multipart/mixed; boundary=001a1133840e386fef04ebd49605 --001a1133840e386fef04ebd49605 Content-Type: multipart/alternative; boundary=001a1133840e386fea04ebd49603 --001a1133840e386fea04ebd49603 Content-Type: text/plain; charset=UTF-8

Understand the different - different part of an Email Header:

·         MIME ver :                   Version of MIME  

·         Received :                    Sender IP address and protocol

·         Date:                              The date the message was sent

·         Delivered To:              Receiver email ID

·         Message-ID:                                The ID of the message

·         Subject:                         The message subject

·         From:                             The message sender email ID

·         To:                                   The message recipient email ID

·         X-Mailer:                      The mail client (mail program) used to send the message

·         Content Type:            The content of Email, like: HTMP, plain text

The From:  line, which contains the sender of the message could be faked easily, so you should not rely on this information.

The lines in green contain the routing information, from the senders computer to the recipients mailserver.

                Let's have a closer look at these lines:

Received: from senderhostname [xxxx.xxxx.xxxx.xxxx] (helo=[ senderhostname]) by mailserver.senderdomain.tld with esmtpa (Exim x.xx) (envelope-from <sender@senderdomain.tld) id yyyy.yyyy.yyyy.yyyy for recipient@recipientdomain.tld; Tue, 01 Apr 2013 10:36:08 -0100

 The message was sent from the senders computer with the IP address xxxx.xxxx.xxxx.xxxx to the mailserver of the sender. In many cases the sender IP xxxx.xxxx.xxxx.xxxx is a dynamic IP address, e.g. DSL. The IP address gives many information's about the sender, the location of the sender and the provider.

Received: from mailserver.senderdomain.tld ([bbb.bbb.bbb.bbb] helo=mailserver.senderdomain.tld) by mailexchanger.recipientdomain.tld with esmtp id xxxxxx-xxxxxx-xx

  The message was transferred from the senders mailserver with the IP address bbb.bbb.bbb.bbb to the recipients mailexchanger. The mailexchanger is the mailserver, which accepts incoming messages for a domain.

Received: from mailexchanger.recipientdomain.tld([ccc.ccc.ccc.ccc]) by mailserver.recipientdomain.tld running ExIM with esmtp id xxxxxx-xxxxxx-xxx; Wed, 2 Apr 2013 11:39:23 +0200

 The message was finally received by the recipients mailserver from the the recipients mailexchanger ccc.ccc.ccc.ccc.

 This is only a sample, which should show the principles. The message routing can contain much more steps, depending on the used mailprovider. It should always be possible to see the sender computer IP address aaa.aaa.aaa.aaa and the sender mailserver bbb.bbb.bbb.bbb if the message was sent from a mail client and a client computer. If the message was sent from a webmail client, then the real IP address of the sender is not included - in this case aaa.aaa.aaa.aaa (if any) will be the IP address of the webmail.
Some might try to fake the routing information, but your mailserver should give you a warning that something is not correct during the transfer from the sender mailserver bbb.bbb.bbb.bbb to the recipient mailexchanger ccc.ccc.ccc.ccc.

Note: Please leave your comments , if you like this articles and send your any query to me, I will get back you with possible solution.

                                                        Regards,

                                      Arun Chaudhary