Received Header
Definition
A header line prepended by each mail server that accepts a message in transit, recording the server's own identity, the IP or hostname it received the message from, and a timestamp. Reading from bottom to top reveals the relay path.
- Added by
- Each mail server relaying the message
- Contains
- Server identity, sending IP or hostname, timestamp
- Read order
- Bottom to top for chronological relay path
- Sub-field
- Digital forensics, email header analysis
Common questions
Why can Received headers be unreliable for tracing spoofed mail?+
Only headers added by servers the message actually passed through are trustworthy, and an earlier or forged Received line inserted by the sender before it reached the first legitimate relay can misrepresent the true origin, so analysts anchor on the header added by a server they control or trust.
What is the practical way to find the true originating IP in a chain of Received headers?+
Analysts trace the chain from the bottom entry upward and look for the first header added by a server known to be legitimate and outside the sender's control, since headers below that point are the ones the actual sending infrastructure could not falsify.
Do all email providers preserve the full Received header chain?+
No, some webmail and forwarding services strip or truncate earlier headers before delivery, which limits how far back the relay path can be reconstructed from the header alone.
Related terms
- DKIM
- DomainKeys Identified Mail. A cryptographic signature placed in a DKIM-Signature header. The signing key sits on the sending server; the public key...
- DKIM (DomainKeys Identified Mail)
- A cryptographic signing mechanism: the sending server signs the message headers and body with a private key, and the receiving server verifies...
- DMARC
- Domain-based Message Authentication, Reporting and Conformance. A DNS policy that stacks on top of SPF and DKIM, telling receivers what to do...
- DMARC (Domain-Based Message Authentication, Reporting, and Conformance)
- A policy layer that requires the domain in the visible From header to align with a domain that passes SPF or DKIM....
- Envelope Sender (Return-Path)
- The address used at the SMTP protocol level for bounce notifications, recorded in the Return-Path header. It is distinct from the display...
- Message-ID
- A globally unique identifier assigned to each message by the originating mail server, recorded in the Message-ID header. It is set by...
- MTA
- Mail Transfer Agent. The server that relays mail server-to-server. Postfix, Exim, Sendmail and Microsoft Exchange are the common implementations. Speaks SMTP.
- MUA
- Mail User Agent. The client the user sees. Outlook, Thunderbird, Apple Mail, Gmail web, Spark, mobile apps. Speaks SMTP outbound and IMAP...
- SPF
- Sender Policy Framework. A DNS TXT record on the sender domain that lists the IP addresses authorised to send mail for that...
- SPF (Sender Policy Framework)
- A DNS-based mechanism by which a domain owner publishes the list of IP addresses authorised to send mail for that domain. A...
Explained in these topics
- Email Forensics: Protocols, Header Tracing, Spoofed MailAn audit line written by each MTA that handles a message, stamped onto the top of the header block. The chain reads bottom-up: the bottom Received is the origi...
- Email Header Analysis and Sender Tracing