MUA
Definition
Mail User Agent. The client the user sees. Outlook, Thunderbird, Apple Mail, Gmail web, Spark, mobile apps. Speaks SMTP outbound and IMAP or POP3 inbound.
- Full name
- Mail User Agent
- Examples
- Outlook, Thunderbird, Apple Mail, Gmail web
- Outbound protocol
- SMTP
- Inbound protocol
- IMAP or POP3
Common questions
Why does distinguishing MUA from MTA matter in a spoofed-email investigation?+
Header fields the MUA generates, such as the From and Subject lines, can be freely set by the sender's client software, while headers added by the receiving MTAs are logged independently of the sender, so examiners weight MTA-added Received headers far more heavily than MUA-supplied fields when verifying true origin.
Does the choice of MUA affect what forensic artefacts are recoverable?+
Yes, different MUAs store local message caches, attachments, and metadata in different formats and locations, for example Outlook's PST/OST files versus Thunderbird's mbox-based profile folders, so examiners need MUA-specific parsing tools to extract a complete local mail artefact set.
Can webmail clients like Gmail be treated the same as desktop MUAs forensically?+
Not entirely: a browser-based MUA like Gmail web typically leaves fewer persistent local artefacts than a desktop client that caches full mailboxes offline, so investigators often rely more on browser cache/history analysis or lawful requests to the provider rather than local mail-store parsing.
Related terms
- DKIM
- DomainKeys Identified Mail. A cryptographic signature placed in a DKIM-Signature header. The signing key sits on the sending server; the public key...
- DMARC
- Domain-based Message Authentication, Reporting and Conformance. A DNS policy that stacks on top of SPF and DKIM, telling receivers what to do...
- MTA
- Mail Transfer Agent. The server that relays mail server-to-server. Postfix, Exim, Sendmail and Microsoft Exchange are the common implementations. Speaks SMTP.
- Received Header
- A header line prepended by each mail server that accepts a message in transit, recording the server's own identity, the IP or...
- SPF
- Sender Policy Framework. A DNS TXT record on the sender domain that lists the IP addresses authorised to send mail for that...