Skip to content
MessagingFORENSICS

Glossary

Message-ID (email header)

The Message-ID header is a globally unique identifier for one email, written in angle brackets by the originating client or first mail server that handled it.

Definition

Message-ID is an email header, defined in RFC 5322, that assigns a unique identifier to a specific message. It looks like an address in angle brackets:

Message-ID: <20240201101500.4f2a9c@mail.example.test>

The left part is typically a timestamp, counter or random string; the right part is usually a host or domain name of the system that generated it. It is set once, by the sender's mail client or the first submission server, and should not change as the message is relayed.

Forensic value

  • Threading. Replies reference it in In-Reply-To and References, which lets you rebuild conversations across mailboxes.
  • Deduplication. The same message found in two mailboxes, an MBOX and a PST export shares one Message-ID.
  • Attribution hints. The format often reveals the generating software or provider: webmail services, Outlook, Exchange and scripted mailers each have recognizable patterns.
  • Correlation with server logs. Mail servers log Message-IDs, so it is the key to request from a provider.

Pitfalls

The header is sender-controlled. Phishing kits and spoofed mail can reuse or forge it, and a domain in the Message-ID that does not match the From domain or the first Received hop is worth investigating, not proof of forgery by itself. Some messages lack the header entirely, in which case a receiving server may add one.