How to Read Email Headers & Check for Time Delays

Email Header

1. X-Spam-Flag: NO
2. X-Authenticated-User:
3. X-Envelope-From:
4. Return-Path:
5. Received: from [] ( [ ])
(authenticated bits=0)
by ( with ESMTP id l5TFq3oj028833;
Fri, 29 Jun 2007 11:52:05 -0400
6. Message-ID:
7. Date: Fri, 29 Jun 2007 11:52:04 -0400
8. From: John Smith
9. User-Agent: Thunderbird (Windows/20070221)
10. MIME-Version: 1.0
11. To:
12. Subject: Blah Blah Blah
13. Content-Type: text/plain; charset=ISO-8859-1; format=flowed
14. Content-Transfer-Encoding: 7bit
15. X-Antivirus: Scanned by F-Prot Antivirus (

Line 1 is our spam filtering system checking to see whether or not the email is considered to be spam.

Line 2 is the account that is authenticating in order to send email out.

Line 3 & 4 is the return email address.

Line 5 is comprised of a few parts:

The first IP address is of the computer that is attempting to receive the email. In this case it is being received on our internal network and the computer that the receiver happened to be on at the time of receiving the email had the IP address of is an example of a proxy server which is how users connect to the “outside world” in order to access webmail. has the example external IP address of

The next part states that our email was received by which is running version 8.13.* version of sendmail. It also gives us the time and day the message was passed along to this server.

Line 6 is a server generated “Message-ID” that is given to every email that is sent out of our servers (and all SMTP servers).

Line 7 is the time/date that actual email was sent out. Note that all times listed in headers is UTC unless otherwise specified. UTC (Coordinated Universal Time) is a newer version of GMT (Greenwich Mean Time).

Line 8 is the From address.

Line 9 states the email client that was used to send out t he email.

Line 10 shows us that the Multipurpose Internet Mail Extensions were used to help format the email to support various things (ie. Certain attachments, different character sets, etc).

Line 11 & 12 are the TO and Subject fields.

Line 13 states that the body of the email contains plain text only. If there were html code included in this email, than you would see something along the lines of “text/html”.

Line 14 is the encoding type.

Line 15 shows that this email was scanned by an antivirus program before being received in the inbox.

When investigating to see if a email has a particular delay. Obtain the headers of the email and look through the time stamps. If you examine the time stamps carefully and convert everything to UTC (GMT), then you should be able to come to a conclusion as to whether or not there is a delay in the email or if there is simply a time zone issue.

How to Convert to UTC (GMT)
Email Header Time
Received: from [] ( [ ])
(authenticated bits=0)
by ( with ESMTP id l5TFq3oj028833;
Mon, 5 Nov 2007 20:11:59 -0500
Mon, 5 Nov 2007 14:46:40 -0700

1) FIND THE TIME AND CONVERT TO UTC! (NOTE: If UTC shows a - [negative] integer, add , If UTC shows a + [positive] integer subtract from the time)

UTC 1= The time stamp your are looking for is Mon, 5 Nov 2007 20:11:59 -0500

* 20:11:59 is the time (Hours:Minutes:Seconds)
* Add 5 to the time
* UTC 1= 25:11:50

UTC 2= The time stamp your are looking for is Mon, 5 Nov 2007 14:46:40 -0700

* 14:46:40 is the time (Hours:Minutes:Seconds)
* Add 7 to the time
* UTC 2= 21:46:40


* Delay = UTC 1 – UTC 2
* Delay = 25:11:50 - 21:46:40 = 3 hours 25 mins 19 secs

  • Email, SSL
  • 2 Users Found This Useful
Was this answer helpful?

Related Articles

Definition: SPF

Sender Policy Framework (SPF) disputes false addresses and allows easy identification of spoofs.

My ISP is blocking outgoing SMTP Port 25, what do I do?

Control Panel: WebsiteOS   Many ISP's block the outgoing mail port default 25. This is called...

PTR Records

Control Panel: WebsiteOS   PTR record a.k.a. Reverse record.i.e. =

Troubleshooting Formmail

Control Panel: WebsiteOS   Troubleshooting Formmail1) Site Builders > Plug-in scripts >...