Mail header

The message delivery with SMTP

Sending and receiving e-mails will usually e-mail clients like Microsoft Outlook Express or does Mozilla Firebird. For better understanding, it is advantageous if the principle of message transmission is known.

To send e-mails, mail programs usually operate their own ISP's mail server, which then takes care of further distribution to the recipient. However, messages can be delivered directly. This requires a DNS query of type "MX", which supplies disposable MX server (Mail eXchange Server) on a domain. Therefore, special programs or online services are used.

In the following example, the fictitious sender "test@tester.tld" send a message to "info@gaijin.at". This will first require the MX server of the domain "gaijin.at". A DNS request is that the MX server "mail.gaijin.at" messages for the domain "gaijin.at"accepts. With a terminal program can now be "mail.gaijin.at" connecting to the host, port 25 (SMTP) was prepared.

After establishing the connection to the mail server responds with the line:

  220 ESMTP server11011.net 

The number 220 at the beginning of the line means that it is in the following text, only an ordinary message and that no error has occurred. Now waiting for the SMTP server to a known idea, which is initiated with the command "HELO" or "EHLO".

  helo faked.tester.tld 

With this command, the station is called "faked.tester.tld" before. The server acknowledges this with the status code 250, which represents a valid command.

  250 server11011.net 

Following is the address of the message, starting with the e-mail address of the sender, which with the command "mail from:" is marked.

  mail from: test@tester.tld 

After the SMTP server has verified the address of the sender and has been found to be valid, it returns the status code 250, usually followed by the text "OK" back.

  250 ok 

Then the e-mail address of the recipient is specified. This is the command "rcpt to:" initiated (English for "recipient").

  rcpt to: info@gaijin.at 

This too is confirmed by the SMTP server:

  250 ok 

Addressing is now complete and the actual message can be sent to the server. For this, the command "data" is used.

  data 

The SMTP server confirms the data command with the status code 354, which prompts for the text. Following the status code, texts such as "go ahead" or "Enter mail, end with". "On a line by itself."

  354 go ahead 

None of the above information must be included in the message arrives at the receiver. So now the typical head-lines like"From", "To" and "Subject" to enter a message. This is also indicated at the beginning of a forged Received: line that is to be deceived about the true sender. However, it will be discussed below in more detail.

After the header line is the actual message text, separated by a blank line is entered.

  Received: from faked.tester.tld (faked.tester.tld [123.45.67.89]) 
  by server11011.net with SMTP; September 1, 2006 13:53:24 +0200 
  Message-Id: <1234567890@tester.tld> 
  X-Sender: test@tester.tld 
  From: "The Faker"  
  To: "Gaijin"  
  Subject: A test 

  Text, text, text 
  Line 2 
  Line 3 
  . 

The message text will always end with a single point on a line. The server acknowledges receipt of the message again with the code 250:

  250 ok 1157111913 qp 7263 

"Quit" command by connecting to the SMTP server is closed.

  quit 

Before the server closes the connection, it returns the status code 221 (confirmation of the quit command) back:

  221 server11011.net 

This completes the connection is closed and the message is stored in the mailbox of the recipient.

The entire above dialogue between client and server now looks like this:

  220 ESMTP server11011.net
 helo faked.tester.tld
 250 server11011.net
 mail from: test@tester.tld
 250 ok
 rcpt to: info@gaijin.at
 250 ok
 data
 354 go ahead
 Received: from faked.tester.tld (faked.tester.tld [123.45.67.89]) 
  by server11011.net with SMTP; September 1, 2006 13:53:24 +0200 
  Message-Id: <1234567890@tester.tld> 
  X-Sender: test@tester.tld 
  From: "The Faker"  
  To: "Gaijin"  
  Subject: A test 

  Text, text, text 
  Line 2 
  Line 3 
  .
 250 ok 1157111913 qp 7263
 quit
 221 server11011.net 

The message reception with POP3

The receiving e-mail works much like the shipping. However, here is a proprietary protocol, the Post Office Protocol (POP), is used. The POP3 server is usually accessible via the port 110.

In the following, the above message sent is retrieved:

  + OK Hello there.
 user xxxxxxxx
 + OK Password required.
 pass xxxxxxxx
 + OK logged in.
 cunning
 + OK
 1598
 .
 retr 1
 + OK 598 octets follow.
 Return-Path:  
  Received: (qmail 7881 invoked from network); September 1, 2006 13:58:33 +0200 
  Received: from m198p010.dipool.highway.telekom.at 
  (HELO tester.tld) ​​(62.46.14.170) 
  by server11011.net with SMTP; September 1, 2006 13:55:38 +0200
 Received: from faked.tester.tld (faked.tester.tld [123.45.67.89])
 by server11011.net with SMTP; September 1, 2006 13:53:24 +0200
 Message-Id: <1234567890@tester.tld>
 X-Sender: test@tester.tld
 From: "The Faker" 
 To: "Gaijin" 
 Subject: A test

 Text, text, text
 Line 2
 Line 3
 .
 quit
 + OK Bye-bye. 

The red highlighted text was inserted by the mail server. Depending on the mail server and the data that was specified when sending the message, the header lines may differ. The first, or in this case, the first and second Received: line is always inserted from the top of their own mail server, so they are definitely authentic.

The Received lines

In our example, arise now Received the following lines:

  Received: (qmail 7881 invoked from network); September 1, 2006 13:58:33 +0200
 Received: from m198p010.dipool.highway.telekom.at
 (HELO tester.tld) ​​(62.46.14.170)
 by server11011.net with SMTP; September 1, 2006 13:55:38 +0200
 Received: from faked.tester.tld (faked.tester.tld [123.45.67.89])
 by server11011.net with SMTP; September 1, 2006 13:53:24 +0200 

Received lines are Zustellvermerke the mail server through which the message was sent. A mail server inserts the Received: line is always up to the message. As a result, that is the Received-entry of the first mail server down and the entry of the last mail server through which the message was conveyed, above.

  Received: (qmail 7881 invoked from network); September 1, 2006 13:58:33 +0200 

Received this line is quite common in the news, it's a note from the mail server "qmail". This line has only limited significance for the traceability of the sender.

  Received: from m198p010.dipool.highway.telekom.at
 (HELO tester.tld) ​​(62.46.14.170)
 by server11011.net with SMTP; September 1, 2006 13:55:38 +0200 

This line was, as well as the first, inserted by the mail server of the recipient and is therefore a good starting point for tracing.The construction of a Received: line is not restricted to specific guidelines, so you should verify all information. Let's look more closely at the individual parts:

  from m198p010.dipool.highway.telekom.at 

Under "from" one hand can be the correct host name of the sender, as in this case. But the computer name or host name, as this was specified in HELO is possible.

  (HELO tester.tld) 

After "HELO" text that is given, which was determined at the greeting when sending messages. This information must be included, but not always.

  (62.46.14.170) 

At the end of the sender (but before "by ...") is in parentheses, the actual sender. This IP address has made the connection to the mail server and delivers the e-mail. This means that the IP address 62.46.14.170 "m198p010.dipool.highway.telekom.at" at the time of sending the host name was. Because of this, with the host name "from ..." identical, it was not raised again.Following information is also available here:

  (M198p010.dipool.highway.telekom.at [62.46.14.170]) 

There is no single form of representation, so that all host names should be checked with the IP address.

  by server11011.net with SMTP 

It is evident that the server "server11011.net" has received the message. The protocol used was SMTP.

  September 1, 2006 13:55:38 +0200 

Separated by a semicolon at the end always follows the date and time of receipt at the mail server. The format of the specified time may be different defies standardization. In our case, the e-mail on 1 September 2006 at 13:55:38 received by the mail server. The times shown in the Received lines are always specified in local time of the mail server. To determine the UTC time can be added to the offset from UTC. In this case it is the words "+0200", which means that the time has led a deviation of plus 2 hours to UTC. Thus was the message on 01.09.2006, accepted by 11:55:38 UTC.

As far as the records of the mail server. Now follow the declared by the sender and partly forged header lines:

  Received: from faked.tester.tld (faked.tester.tld [123.45.67.89])
 by server11011.net with SMTP; September 1, 2006 13:53:24 +0200 

As already indicated, the message can also run more than one mail server, with the Received: line of a mail server is added at the top. In each Received: line is both the sender ("from ...") and the receiver ("by ...") included. As a result must be that the sender of the first line and the receiver of the second row are identical, or at least similar. In our example, this is not the case:

  Received: from m198p010.dipool.highway.telekom.at (62.46.14.170)
      by server11011.net

 Received: from faked.tester.tld (faked.tester.tld [123.45.67.89])
      by server11011.net 

A plausible course of the message could look like this (simplified):

  Received: from mail.target.tld (12.34.56.78)
      by mx.target.tld

 Received: from mx3.provider1.tld (123.45.67.3)
      by target.tld

 Received: from mx1.provider1.tld (123.45.67.1)
      by mx3.provider1.tld

 Received: from user1.provider1.tld (123.45.67.89)
      by mx1.provider1.tld 

Header lines in detail

The following list contains only the essential headers. Depending on your mail client, mail server or to any mailing lists can still occur more lines.

BCC

BCC: Webmaster

Additional recipients to receive the message as "invisible" copy. In the BCC field recipients are those additional company that you wish not to see the other recipients. The recipient in the To and CC line are visible to all recipients.

CC

CC: Info

Additional recipients to receive the message "copy". This information is provided only for administrative purposes. The e-mail is delivered, however, so as if the address in the To header would be included, as are the addresses from the fields "To" and"CC" in the SMTP dialogue in "RCPT TO" pass.

Content-Transfer-Encoding

Content-Transfer-Encoding: quoted-printable

This header line specifies how the message body is encoded. In addition to specifying "quoted-printable" are also "base64", "7bit" and "8bit" common.

Content-Type

Content-Type: text/plain; charset=ISO-8859-1

This line specifies the type of message, in this case it is a simple text message. Behind the "charset" follows the character set used.

Date

Date: Wed, 6 Sept 2006 10:02:47 +0200

The preparation time or the time of sending local (drop in the Outbox). This time information is added by the mail program.The time is always specified in local time of the sending computer. In the end, followed by either the difference from UTC (here +2 hours), or in some cases the time zone, such as: "(EST)."

From

From: Info

The sender, who was entered by the sender.

Message-ID

Message-ID:

In the message ID, it should be a unique identifier of the message. This identifier is the mail program, mostly from the date generated. If you are missing the message ID, it is usually created by a mail server and added.

Organization

Organisation: Gaijin.at

In this header line may be the company name of the sender.

References

References:

If a message refers to an existing e-mail about this answer, the message ID of the original message in the line "References" is entered. This information is used by most email programs to sort the messages or display them hierarchically.

Reply-To

Reply-To: webmaster@gaijin.at

"Reply-To" address that can be entered, to which the reply should be sent if the answer does not address the same as the sending address (From) is.

Return-Path

Return-Path:

The address to which the e-mail will be returned when a service of the notification was not possible. To the original e-mail from the mail server that could not deliver the message, added an error message. The return path may be entered from a mail server based on the number at "MAIL FROM".

Transmitter

Sender:

If the author and the technical sender are different, for example, if a message from a mailing list, is the technical sender in the line "stations".

Subject

Subject: Ein Betreff

The subject of a message.

To

  To: "Webmaster of gaijin.at" , name@domain.tld,
 Info , mail@adresse.tld (first name last name) 

The recipient or recipients. For multiple addresses must be separated by a comma. The order of the addresses and names can vary.

X-Accept-Language

X-Accept-Language: de, en

In this header line by the shipper accepted languages ​​are given. Replies to this message should be written in these languages.

X-Mailer

X-Mailer: Microsoft Outlook Express 6.00.2800.1106

The name and usually the version number used to send e-mail program.

X-Priority

X-Priority: 3 (Normal)

This header field specifies the priority of the message. This value is only of interest to the recipient and sender, but has no influence on the speed of sending. The possible priorities are usually 1 (very high), 2 (high), 3 (normal), 4 (low), 5 (very low).Sometimes, after the priority value is the description given, eg "3 (Normal)".

X-MSMail-Priority

X-MSMail-Priority: Normal

This is an inserted Microsoft mail programs header that indicates the priority of the message. This value is only of interest to the recipient and sender, but has no influence on the speed of sending.

X-Sender

X-Sender: test@tester.tld

In this line, add some headers that mail server address that was specified in the SMTP dialogue, "MAIL FROM".

Source: http://www.gaijin.at/manmailhead.php (in German)

The English ver by Google translator: link