Glossary
Received header (email)
A Received header is a trace line each mail server prepends when it accepts a message, recording the sending host, the receiving host and a timestamp.
Definition
Received: is a trace header defined in RFC 5321 and RFC 5322. Every SMTP server that accepts a message adds one at the top of the header block, so the list reads in reverse order: the topmost line is the last hop, the bottom line the first.
Received: from mx.relay.example.test (mx.relay.example.test [198.51.100.25])
by mail.recipient.example.test with ESMTPS id 4f2a9c
for <j.doe@example.test>; Thu, 01 Feb 2024 11:15:02 +0100
A typical line contains a from clause (the name the client announced plus the connecting IP as seen by the server), a by clause (the receiving server), the protocol, a queue ID, and an RFC 2822 date after the semicolon.
Forensic value
- Path reconstruction. Reading bottom to top traces the message from origin to mailbox.
- Originating IP. The lowest hop added by infrastructure you trust often exposes the sender's IP address or submission server.
- Independent clock. Each hop's timestamp comes from a different server, so gaps, reversed times or large skews stand out against the sender-controlled
Date:header.
Pitfalls
Only hops added by servers you trust are reliable. Anything below them can be forged by the sender, who may insert fake Received lines. Server clocks can be wrong, and time zones differ per hop, so convert every timestamp to UTC before comparing.