Email Headers - Revision history

Jessek at 14:04, 14 February 2009

2009-02-14T14:04:50Z

.FUF: replaced obsolete wikipedia link

2008-07-18T14:54:25Z

replaced obsolete wikipedia link

Jessek: Added Signature Links

2007-06-18T12:32:00Z

Added Signature Links

Jessek: /* External Links */ - Cleaned up links

2007-04-21T17:34:12Z

‎External Links: - Cleaned up links

Jessek: /* Message Id Field */ - Moved to new article

2007-04-21T17:24:10Z

‎Message Id Field: - Moved to new article

Jessek: /* Message Id Field */ - Added link

2007-03-19T12:48:03Z

‎Message Id Field: - Added link

Jessek: /* Mail User Agents */ - Cleaned up text

2007-03-19T12:47:28Z

‎Mail User Agents: - Cleaned up text

Jessek: /* Mail User Agents */ - Fixed typo

2007-03-06T19:37:48Z

‎Mail User Agents: - Fixed typo

Jessek: Moved Header formats to new page

2007-03-06T05:24:54Z

Moved Header formats to new page

Jessek: /* Servers in Transit */

2007-02-27T03:52:43Z

‎Servers in Transit

← Older revision		Revision as of 14:04, 14 February 2009
Line 4:		Line 4:

	There is no single way to make sense of email headers. Some examiners favor reading from the bottom up, some favor reading from the top down. Because information in the headers can be put there by the user's [[Mail User Agent\|MUA]], a server in transit, or the recipient's [[Mail User Agent\|MUA]], it can be difficult to determine when a line was added.		There is no single way to make sense of email headers. Some examiners favor reading from the bottom up, some favor reading from the top down. Because information in the headers can be put there by the user's [[Mail User Agent\|MUA]], a server in transit, or the recipient's [[Mail User Agent\|MUA]], it can be difficult to determine when a line was added.
		+
		+	=== Sender's IP Address ===
		+	{{main\|IP addresses in webmail messages}}
		+	Some web-based email providers include the sender's IP address in the message headers. Some do not.

	=== Mail User Agents ===		=== Mail User Agents ===

@@ Line 17: / Line 17: @@
 == Message Id Field ==
-{{main|Using message id headers to determine if an email has been forged}}According to the current guidelines for email [http://www.faqs.org/rfcs/rfc2822.html], every message should have a Message-ID field. These id fields can be used to determine if a message has been forged. It is harder, but sometimes possible, to show that a message is authentic using the message id field. Where known, the Message-ID algorithms for known programs are [[List of MUA Header Formats|given on the separate pages for those programs]].
+{{main|Using message id headers to determine if an email has been forged}}. According to the current guidelines for email [http://www.faqs.org/rfcs/rfc2822.html], every message should have a Message-ID field. These id fields can be used to determine if a message has been forged. It is harder, but sometimes possible, to show that a message is authentic using the message id field. Where known, the Message-ID algorithms for known programs are [[List of MUA Header Formats|given on the separate pages for those programs]].
 == Signature Fields ==
-{{main|Using signature headers to determine if an email has been forged}}Some email programs allow users to sign messages. This gives the recipient some assurance that the sender given in the message really sent the message. Obviously these headers can be used by an examiner for the same purpose.
+{{main|Using signature headers to determine if an email has been forged}}. Some email programs allow users to sign messages. This gives the recipient some assurance that the sender given in the message really sent the message. Obviously these headers can be used by an examiner for the same purpose.
 == Sample Header ==
@@ Line 58: / Line 58: @@
 == External Links ==
-* [http://en.wikipedia.org/wiki/Computer_forensics#E-mail_Headers Wikipedia entry on email headers]
+* [http://en.wikipedia.org/wiki/E-mail#Header Wikipedia entry on email headers]

@@ Line 18: / Line 18: @@
 == Message Id Field ==
 {{main|Using message id headers to determine if an email has been forged}}According to the current guidelines for email [http://www.faqs.org/rfcs/rfc2822.html], every message should have a Message-ID field. These id fields can be used to determine if a message has been forged. It is harder, but sometimes possible, to show that a message is authentic using the message id field. Where known, the Message-ID algorithms for known programs are [[List of MUA Header Formats|given on the separate pages for those programs]].
 == Sample Header ==

@@ Line 55: / Line 55: @@
 == External Links ==
+* [http://en.wikipedia.org/wiki/Computer_forensics#E-mail_Headers Wikipedia entry on email headers]
 * http://en.wikipedia.org/wiki/Computer_forensics#E-mail_Headers
-* http://www.forensictracer.com software for forensic analysis of internet resources

@@ Line 17: / Line 17: @@
 == Message Id Field ==
+{{main|Using message id headers to determine if an email has been forged}}According to the current guidelines for email [http://www.faqs.org/rfcs/rfc2822.html], every message should have a Message-ID field. These id fields can be used to determine if a message has been forged. It is harder, but sometimes possible, to show that a message is authentic using the message id field. Where known, the Message-ID algorithms for known programs are [[List of MUA Header Formats|given on the separate pages for those programs]].
-According to the current guidelines for email [http://www.faqs.org/rfcs/rfc2822.html RFC 2822]), every email should have a Message-ID field:
-<pre>   The "Message-ID:" field provides a unique message identifier that
-   refers to a particular version of a particular message.  The
-   uniqueness of the message identifier is guaranteed by the host that
-   generates it (see below).  This message identifier is intended to be
-   machine readable and not necessarily meaningful to humans.  A message
-   identifier pertains to exactly one instantiation of a particular
-   message; subsequent revisions to the message each receive new message
-   identifiers.
-−
-   ...
-−
-   The message identifier (msg-id) itself MUST be a globally unique
-   identifier for a message.  The generator of the message identifier
-   MUST guarantee that the msg-id is unique.  There are several
-   algorithms that can be used to accomplish this.  Since the msg-id has
-   a similar syntax to angle-addr (identical except that comments and
-   folding white space are not allowed), a good method is to put the
-   domain name (or a domain literal IP address) of the host on which the
-   message identifier was created on the right hand side of the "@", and
-   put a combination of the current absolute date and time along with
-   some other currently unique (perhaps sequential) identifier available
-   on the system (for example, a process id number) on the left hand
-   side.  Using a date on the left hand side and a domain name or domain
-   literal on the right hand side makes it possible to guarantee
-   uniqueness since no two hosts use the same domain name or IP address
-   at the same time.  Though other algorithms will work, it is
-   RECOMMENDED that the right hand side contain some domain identifier
-   (either of the host itself or otherwise) such that the generator of
-   the message identifier can guarantee the uniqueness of the left hand
-   side within the scope of that domain.</pre>
-−
 Where known, the Message-ID algorithms for known programs are [[List of MUA Header Formats|given on the separate pages for those programs]].
 == Sample Header ==

@@ Line 7: / Line 7: @@
 === Mail User Agents ===
 {{main|List of MUA Header Formats}}
-Every [[Mail User Agent|MUA]] sets up the headers for a message slightly differently. The format and order of the entries can vary slightly under the [http://www.faqs.org/rfcs/rfc2822.html RFC 2822]. The examiner can use this to show that messages were forged, but not that they were legitimate. For example, if a message purports to be from [[Apple Mail]] but the order or the headers do not match the [[Apple Mail Header Format]], the message has been forged. If the headers of the message do match that format, however, it does not guarantee that the message was sent by that program.
+Every [[Mail User Agent|MUA]] sets up the headers for a message slightly differently. Although some headers are required under the applicable [http://www.faqs.org/rfcs/rfc2822.html RFC], their format and ordering can vary by client. Almost all clients, however, add their headers in a fixed format and order.
 === Servers in Transit ===

@@ Line 15: / Line 15: @@
 Mail servers can add lines onto email headers, usually in the form of "Received" lines, like this:
 <pre>Received: by servername.recipeienthost.com (Postfix, from userid 506)
-	id 77C30808A; Sat, 24 Feb 2007 20:43:56 -0500 (EST)<pre>
+	id 77C30808A; Sat, 24 Feb 2007 20:43:56 -0500 (EST)</pre>
 == Message Id Field ==