Reading Headers with MX Tool Box By Matt Flederbach

Size: px

Start display at page:

Download "Reading Headers with MX Tool Box By Matt Flederbach"

Conrad Knight
6 years ago
Views:

1 Reading Headers with MX Tool Box By Matt Flederbach Often times, you'll get a customer asking Why did it take so long for my to be delivered? or Why was my blocked? or even Why was this marked as spam?. You'll need to review the headers of such s. A lot of people find it difficult to interpret headers. Luckily, there are a few great tools on-line for helping with this task. One of the best that I've found is at mxtoolbox.com: When you open that link, you'll see a box with an orange box next to it that says Analyze Header After you input the full headers into this box, click that Analyze Button. If you need helping getting the headers for an , check out the help desk article: It'll take a second to analyze, but then you should be presented with a screen with a bunch on info. I'm not sure how long MxToolBox keeps the analysis, but until they remove it, here is one that I just ran: 53a The top of the page shows how long it took the from start to finish: In the one, you can see that it took this 1 second to be delivered. Below that, is a break down of how long the took at each hop. I usually skip looking at the graph because its pretty deceiving as

you'll see in the next picture: At first glance, it looks like this email took 3 seconds to be delivered. The graph rounds up though(better than rounding down).

2 you'll see in the next picture: At first glance, it looks like this took 3 seconds to be delivered. The graph rounds up though(better than rounding down). In the table below, you can see a break down of each hop, along with time stamps: In this table, you can get a lot of questions answered. You can see how many hops the took, which in this case is 3. The went from my work station by way of mail.bluehost.com, to mx.google.com, and finally to one of googles internal servers at It took less than a section to go from my workstation to mail.bluehost.com(the first bar on the bar graph), a second to go from mail.bluehost.com to mx.google.com(the second bar), and then less than a second to go from mx.google.com to (the third bar). In the second column, this table shows you the delay between the hops. The 6th column shows you the time stamps. You can use this to show how long the time stamp actually took to get from the sender, to the recipient. Be careful though, as the headers do not always take into account time zone differences. An example of this, if if you have the customer send you a test , and it takes 20 minutes to get to your address. Because of time differences, MxToolBox may show the has having taken 7 hours to deliver the .

Below this section, there is another table. This table shows the HeaderName and the HeaderValue: In this table, there are a number of important fields that are displayed.

3 Below this section, there is another table. This table shows the HeaderName and the HeaderValue: In this table, there are a number of important fields that are displayed. Check the Appendix of this document for details on a number of fields and what they mean. The next section on this page in the Received header. This what what you typed into the box on the first page:

4 This is section great, because when you ask someone for help with a set of headers, this allows the person helping to easily get a copy of the original headers, without the ugly mess of posting them into Gator Chat(which will sometimes cut off parts of the headers, or without having to send the headers through XMPP(Jabber). In addition, it also gives the person helping you a set of already interpreted headers. Another great thing about this is that you can send it to customers, and it will show them much more easily what is going on with their rather than having them look through the raw headers for timestamps, and who the sender is, and so on. This tool puts all the info you need in an easy to read, clean format. Remember, if you have any questions about reading headers, just ask your friendly neighborhood L2. They are always willing to help out!

5 Appendix Remember, not all of these fields are required, and many of them are able to be spoofed quite easily. This is not a comprehensive list, but includes the most used Headernames. From: This is the sending address. This can be forged, so don't always trust that an actually came from this address. To: This is who the is addressed to. Not to be confused with envelope-to. Date: This is the time stamp of when the message was sent. Return-Path: This is the addresses that bounce backs should be sent to. Most mail servers observe this and will send the bounces to this address, but not all. In the case where one doesn't, there isn't anything we can do. Thats configured by the recipients Mail Server Admin. Delivery-Date: This is the time stamp of when the message was delivered to the recipient. Message-ID: This is a unique ID of the message. This is used for identifying an . X-Mailer: This is the program that sent the message. It might be listed as Mozilla Thunderbird for example. Subject: This is the subject line that the sender has chosen to include. Envelope-To: This is the actual address the the is delivered to. Received: There are usually multiple of these in a set of headers. This field indicates which mail servers the passed through on its way to the destination. This is what is best read from bottom to top, so that you can see the path that the message took. Delivered-To: This is the actual address that the message was delivered to. If there is a forwarder set up, you'll often see this field in the headers of the forwarded message because the messages was delivered to the new address(as dictated by the forwarder. Received-SPF: Defines whether or not the message passed the SPF check. You'll generally see Pass or Fail here along with a short explanation of why it passed or failed. Authentication-Results: This is where the recipient mail server records the results of the authentication checks that it performed. User-Agent: This field displays the what software was used to sent the . Content-Transfer-Encoding: This defines the method of representing the binary data. Messages do not have to be sent via ASCII. They can be sent in a number of different formats such as 7bit, quotedprintable, base64, 8bit, and binary.

6 MIME-Version: This indicates that the message is MIME formated. This allows for the use of character sets other than ASCII, non-text based attachments(think of.pdf,.doc, and so on), message bodies with multiple parts, and header info in non-ascii character sets. Without MIME, messages could only be sent in languages that use 7-bit ASCII (A through Z, 1 through 0). Content-Type: This field specifies what the message is composed of. This is usually HTML or Plain text. X-Spam-Status: This is information on whether or not the message is spam. The content here can vary, but generally includes yes or no. The score that the X-Spam-Checker-Version assigns the message, and the required score to mark as spam. X-Spam-Level: This shows the spam score assigned to the message by the service that scans the to determine if the message is spam. Message Body: This is the actual body of the message.

Internet Architecture

Internet Architecture Lecture 10: How Email Work Assistant Teacher Samraa Adnan Al-Asadi 1 How Email Works Electronic mail, or email, might be the most heavily used feature of the Internet. You can use