How to Read Email Headers & Check for Time Delays

Email Header


1. X-Spam-Flag: NO
2. X-Authenticated-User: mail.domain.com
3. X-Envelope-From: name@whatever.com
4. Return-Path:
5. Received: from [192.168.2.110] (proxy.whatever.com [98.136.45.79 ])
(authenticated bits=0)
by mail69c2.megamailservers.com (8.13.6.20060614/8.13.1) with ESMTP id l5TFq3oj028833;
Fri, 29 Jun 2007 11:52:05 -0400
6. Message-ID:
7. Date: Fri, 29 Jun 2007 11:52:04 -0400
8. From: John Smith
9. User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
10. MIME-Version: 1.0
11. To: user@otheremailaccount.com
12. Subject: Blah Blah Blah
13. Content-Type: text/plain; charset=ISO-8859-1; format=flowed
14. Content-Transfer-Encoding: 7bit
15. X-Antivirus: Scanned by F-Prot Antivirus (http://www.f-prot.com)



Line 1 is our spam filtering system checking to see whether or not the email is considered to be spam.

Line 2 is the account that is authenticating in order to send email out.

Line 3 & 4 is the return email address.

Line 5 is comprised of a few parts:

The first IP address is of the computer that is attempting to receive the email. In this case it is being received on our internal network and the computer that the receiver happened to be on at the time of receiving the email had the IP address of 192.168.2.110.

proxy.whatever.com is an example of a proxy server which is how users connect to the “outside world” in order to access webmail. Proxy.whatever.com has the example external IP address of 98.136.45.79.

The next part states that our email was received by mail69c2.megamailservers.com which is running version 8.13.* version of sendmail. It also gives us the time and day the message was passed along to this server.

Line 6 is a server generated “Message-ID” that is given to every email that is sent out of our servers (and all SMTP servers).

Line 7 is the time/date that actual email was sent out. Note that all times listed in headers is UTC unless otherwise specified. UTC (Coordinated Universal Time) is a newer version of GMT (Greenwich Mean Time).

Line 8 is the From address.

Line 9 states the email client that was used to send out t he email.

Line 10 shows us that the Multipurpose Internet Mail Extensions were used to help format the email to support various things (ie. Certain attachments, different character sets, etc).

Line 11 & 12 are the TO and Subject fields.

Line 13 states that the body of the email contains plain text only. If there were html code included in this email, than you would see something along the lines of “text/html”.

Line 14 is the encoding type.

Line 15 shows that this email was scanned by an antivirus program before being received in the inbox.

TIME ZONES
When investigating to see if a email has a particular delay. Obtain the headers of the email and look through the time stamps. If you examine the time stamps carefully and convert everything to UTC (GMT), then you should be able to come to a conclusion as to whether or not there is a delay in the email or if there is simply a time zone issue.


How to Convert to UTC (GMT)
Email Header Time
Received: from [192.168.2.110] (proxy.whatever.com [98.136.45.79 ])
(authenticated bits=0)
by mail69c2.megamailservers.com (8.13.6.20060614/8.13.1) with ESMTP id l5TFq3oj028833;
Mon, 5 Nov 2007 20:11:59 -0500
Message-ID:
Mon, 5 Nov 2007 14:46:40 -0700


1) FIND THE TIME AND CONVERT TO UTC! (NOTE: If UTC shows a - [negative] integer, add , If UTC shows a + [positive] integer subtract from the time)

UTC 1= The time stamp your are looking for is Mon, 5 Nov 2007 20:11:59 -0500

* 20:11:59 is the time (Hours:Minutes:Seconds)
* Add 5 to the time
* UTC 1= 25:11:50


UTC 2= The time stamp your are looking for is Mon, 5 Nov 2007 14:46:40 -0700

* 14:46:40 is the time (Hours:Minutes:Seconds)
* Add 7 to the time
* UTC 2= 21:46:40


2) FIND THE DELAY

* Delay = UTC 1 – UTC 2
* Delay = 25:11:50 - 21:46:40 = 3 hours 25 mins 19 secs


Was this answer helpful?

 Print this Article

Also Read

What are your Secure Email server settings?

Control Panel: WebsiteOSEnable SSL for incoming & outgoing Incoming Mail Server:...

My ISP is blocking outgoing SMTP Port 25, what do I do?

Control Panel: WebsiteOS   Many ISP's block the outgoing mail port default 25. This is called...

Troubleshooting Formmail

Control Panel: WebsiteOS   Troubleshooting Formmail1) Site Builders > Plug-in scripts >...

Definition: SPF

Sender Policy Framework (SPF) disputes false addresses and allows easy identification of spoofs.

What are your POP3 and SMTP server settings?

Control Panel: WebsiteOS   POP3 (incoming) Server: mail.domain.com SMTP (outgoing)...