Analyzing SMTP Mail Headers | ExchangeDefender [ Skip to content ](#main) [ ![ExchangeDefender](/assets/images/xd_logo_blue.png) ](/) Email Security ![Platform Overview](/assets/images/m-xd-pro.png)### ExchangeDefender PRO Enterprise-grade email security made simple for every business. [Sign Up](/sign-up) [Live Demo](/demo) [Email Security Stops spam, malware & phishing in real time. ](/email-security) [Encryption Secure your emails, attachments & sensitive data. ](/corporate-email-encryption) [Web File Sharing Easy, safe cloud file sharing with access control. ](/web-file-server) [Live Archive Locked-in email backup & continuity during outages. ](/livearchive-backup) [Emergency Inbox Keep email flowing without interruption if your provider fails. ](/inbox) [Spearphish Train your team with phishing simulations & risk tracking. ](/spearphishing) Managed Email ### Enterprise-Grade Managed Email Reliable, secure, and fully managed email operations for modern organizations. ![ExchangeDefender](/assets/images/managed_email_menu.png) [Microsoft365/Google Email Management Expert management and security for Microsoft 365 and Google Workspace email. ](/managed-email-operations) [AI Advisory Secure, practical AI consulting & implementation for SMBs. ](/management-ai) Company ### ExchangeDefender: 29+ Years of Trust We are a cybersecurity company focused on business email protection, with 29+ years of experience keeping organizations secure, connected, and resilient. ![ExchangeDefender](/assets/images/careers_1.png) [ About Us Learn our purpose, values, and the mission behind every decision. ](/about-us) [ Blog News, product updates and email security insights. ](/blog) [ Capabilities Discover the tech and expertise that keep your email secure around the clock ](/capabilities) [ Careers Be part of a team using modern tech to solve real threats and ship great work. ](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human Open menu Menu ---- Email Security [Email Security](/email-security) [Encryption](/corporate-email-encryption) [Web File Sharing](/web-file-server) [Live Archive](/livearchive-backup) [Inbox](/inbox) [Spearphish](/spearphishing) Managed Email [Microsoft365/Google Email Management](/managed-email-operations) [AI Advisory](/management-ai) Company [About Us](/about-us) [Blog](/blog) [Capabilities](/capabilities) [Careers](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human Search documentation On this page On this page ------------ - [Getting SMTP Headers](#getting-SMTP-headers) - [Analyzing SMTP Headers](#analyzing-SMTP-headers) - [Exporting Messages](#exporting-messages) - [Exporting Messages from Outlook](#exporting-messages-from-outlook) - [Exporting Messages from Outlook Web Access](#exporting-messages-from-owa) - [Exporting Messages from Gmail](#exporting-messages-from-gmail) [ Documentation ](https://www-preview.exchangedefender.com/docs) [Documentation](https://www-preview.exchangedefender.com/docs)Analyzing SMTP Mail Headers =========================== Analyzing SMTP Mail Headers ExchangeDefender uses SMTP headers to help troubleshoot mail delivery problems and delays. Every email message consists of email headers and the email body. Email body includes all the message text, encoded attachments, etc and is generally what you see when you open an email. Email headers are typically hidden and contain a lot of transit information that mail servers print in the header of the message as it passes through them. This article will show you how to locate SMTP headers and how to interpret and analyze them. Getting SMTP Headers [¶](#getting-SMTP-headers) ------------------------------------------------- **Outlook 2010 - current** Double click to open a message in it's own window: **File > Info > Properties > Internet Headers** ![](/images-documentation/smtp-headers-outllook-2010.png) **Outlook Web App (OWA)** Open the message in it's own window: Down arrow next to Repy all > View message details ![](/images-documentation/smtp-headers-outllook-web-app.png) **Apple Mail** View > Message > Raw Source **Outlook 2018 for Mac** From the message listing: Control + Click >> View Source **Gmail** Open the message: Down arrow next to Reply > Show Original ![](/images-documentation/smtp-headers-gmail.png) Most of the time SMTP headers are too long to display in a small box (note scroll bars on the side) so make sure you select and copy all the text in them before opening a support request. ExchangeDefender prefers having the entire message submitted, so if you can save the entire message in an .msg file we’ll dig for the SMTP headers for you. Analyzing SMTP Headers [¶](#analyzing-SMTP-headers) ----------------------------------------------------- When you compose a new message, your email client (MUA, Mail User Agent) submits the message along with any attachments to a mail sever with the basic SMTP headers indicating From, To, Subject, and so on. After that, every mail server that processes the message will put it’s own routing diagnostics at the top of the SMTP headers. There are many SMTP header analyzers available for free on the Internet where you can paste your headers and get a pretty and intuitive graphical breakdown of the message, contents, and delays. In general, your SMTP headers may look something like this: Received: from MBOX7.dal.exch.xd-mail.online (192.168.170.7) by MBOX1.dal.exch.xd-mail.online (192.168.170.1) with Microsoft SMTP Server (version=TLS1\_2, cipher=TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256) id 15.1.1531.3 via Mailbox Transport; Thu, 23 Jul 2020 22:43:48 -0400 Received: from MBOX6.dal.exch.xd-mail.online (192.168.170.6) by MBOX7.dal.exch.xd-mail.online (192.168.170.7) with Microsoft SMTP Server (version=TLS1\_2, cipher=TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256) id 15.1.1531.3; Thu, 23 Jul 2020 22:43:48 -0400 Received: from XDON-DAL-EDGE1.dal.exch.xd-mail.online (192.168.190.10) by MBOX6.dal.exch.xd-mail.online (192.168.170.6) with Microsoft SMTP Server (version=TLS1\_2, cipher=TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256) id 15.1.1531.3 via Frontend Transport; Thu, 23 Jul 2020 22:43:48 -0400 Received: from duckburg.exchangedefender.com (65.99.255.23) by XDON-DAL-EDGE1.dal.exch.xd-mail.online (192.168.190.10) with Microsoft SMTP Server (version=TLS1\_2, cipher=TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384) id 15.1.1531.3; Thu, 23 Jul 2020 22:42:19 -0400 Received: from mx1.slc.paypal.com (mx0.slc.paypal.com \[173.0.84.225\]) by duckburg.exchangedefender.com (8.14.7/8.14.7) with ESMTP id 06O2h1LX025300 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Thu, 23 Jul 2020 22:43:02 -0400 DKIM-Signature: v=1; a=rsa-sha256; d=paypal.com; s=pp-dkim1; c=relaxed/relaxed; q=dns/txt; i=@paypal.com; t=1595558581; h=From:From:Subject:Date:To:MIME-Version:Content-Type; bh=0UdynO8yHqgNmi+Y07Cg5PgD0UkUheWWZH5GPvOwZ5I=; b=0MLRhP/3yQSRmAL6QYs6Gun7EK12BU43deNCiLXjKLWXhqyVhCqGmYsU5Oapgmbf mEGN1dqoydjG8xwWFZkHw7FnA8dL4rVhKrQZ9tG5lhp6Km/pGQUMpvlH7DuDg77D eLXq5NzFRPRDo1bXlw/BRPpgZE1aSne/fWaGskdzSrgtm6sbubTFanGDQj+p/If/ KTCCNilH3F+XDQpUKzKxzsyKzd2gTQlA9nEqXYrX7ruMRvG6ZSFRZPR1hP/p9Qkr M4NRAHW9Hnbx9sh7ipBzjwmBmPWLzKSVgSDRLW7FBL1dpbYO2Q4fnAppLXurjPGG +c3+u5i7dqj+dsV78y7nSA==; Received: (qmail 3685648 invoked by uid 993); 24 Jul 2020 02:43:01 -0000 Date: Thu, 23 Jul 2020 19:43:01 -0700 Message-ID: <1595558581.3685648@paypal.com> X-PP-Priority: 0-none-false AMQ-Delivery-Message-Id: EMAILDELIVERY-Notification\_EmailDeliveryEvent-5-1595558574658-288606171 X-PP-REQUESTED-TIME: 1595558571935 X-PP-Email-transmission-Id: 5fed7b4e-cd57-11ea-a9f7-b875c0bfd1b3 PP-Correlation-Id: 52ddcd53e2d25 Subject: Receipt for Your Payment to Microsoft Corporation X-MaxCode-Template: PPX001066 To: Vladimir Mazek From: "service@paypal.com" X-Email-Type-Id: PPX001066 Content-Transfer-Encoding: base64 Content-Type: text/html; charset=UTF-8 MIME-Version: 1.0 X-ExchangeDefender-Info: ExchangeDefender Mail Security X-ExchangeDefender-VirusScan: Found to be clean X-ExchangeDefender-SpamScan: not spam, SpamAssassin (score=4.002, required 5, autolearn=disabled, DCC\_CHECK 5.50, DCC\_REPUT\_70\_89 4.00, DIGEST\_MULTIPLE 0.00, DKIMWL\_WL\_HIGH -0.00, DKIM\_SIGNED 0.10, DKIM\_VALID -0.10, DKIM\_VALID\_AU -0.10, HTML\_FONT\_LOW\_CONTRAST 0.00, HTML\_MESSAGE 0.00, MIME\_HTML\_ONLY 0.10, PYZOR\_CHECK 1.98, RCVD\_IN\_DNSWL\_BLOCKED 0.00, RCVD\_IN\_MSPIKE\_H3 0.00, RCVD\_IN\_MSPIKE\_WL 0.00, SPF\_HELO\_NONE 0.00, T\_KAM\_HTML\_FONT\_INVALID 0.01, URIBL\_BLOCKED 0.00, USER\_IN\_DEF\_DKIM\_WL -7.50) X-ExchangeDefender-SpamScore: 4 X-ExchangeDefender-From: service@paypal.com Return-Path: service@paypal.com X-MS-Exchange-Organization-Network-Message-Id: 98c38cec-bf35-463b-339b-08d82f7b2f41 X-MS-Exchange-Organization-AuthSource: XDON-DAL-EDGE1.dal.exch.xd-mail.online X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Exchange-Transport-EndToEndLatency: 00:01:29.3013741 X-MS-Exchange-Processed-By-BccFoldering: 15.01.1531.003 Each line in the SMTP headers contains vital information that the server processing the message wanted to note. Many of these lines are used to determine processing delays, mail delivery issues, evaluate routing, why a message went to SPAM, where it was sent from, and so on. Because every mail server can add lines as the message passes through them, these lines are also subject to spoofing and other malicious behavior so while useful in troubleshooting not every line is trustworthy. Here is a summary of the SMTP headers you’ll often see: FromThis displays who the message is from, however, this can be easily forged and can be the least reliable.SubjectThis is what the sender placed as a topic of the email content.BodyThis is the actual content of the email itself, written by the sender.DateThis shows the date and time the email message was composed.ToThis shows to whom the message was addressed, but may not contain the recipient's address.Return-PathThe email address for return mail. This is the same as "Reply-To:".Envelope-ToThis header shows that this email was delivered to the mailbox of a subscriber whose email address is user@example.com.Delivery DateThis shows the date and time at which the email was received.ReceivedThe received is the most important part of the email header and is usually the most reliable. They form a list of all the servers/computers through which the message traveled in order to reach you. The received lines are best read from bottom to top. That is, the first "Received:" line is your own system or mail server. The last "Received:" line is where the mail originated. Each mail system has their own style of "Received:" line. A "Received:" line typically identifies the machine that received the mail and the machine from which the mail was received. Dkim-Signature & Domainkey-SignatureDomainKey Signature string. You can learn more about these by visiting: http://en.wikipedia.org/wiki/DomainKeys.Message-idA unique string assigned by the mail system when the message is first created. These can easily be forged.Mime-VersionMultipurpose Internet Mail Extensions (MIME) is an Internet standard that extends the format of email. Please see http://en.wikipedia.org/wiki/MIME for more details.Content-TypeGenerally, this will tell you the format of the message, such as html or plaintext.Message BodyThis is the actual content of the email itself, written by the sender.X-ExchangeDefender-VirusScanExchangeDefender virus report, either found to be clean or infected.X-ExchangeDefender-SpamScan ExchangeDefender SPAM signatures and definitions. This important block identifies all the SPAM definitions this email containedX-MS-ExchangeMicrosoft Exchange-specific headers and routing information. ExchangeDefender often uses SMTP headers to help troubleshoot email delivery delays. You can always paste your SMTP headers into a Header Analyzer such as [https://mxtoolbox.com/EmailHeaders.aspx](https://mxtoolbox.com/EmailHeaders.aspx) which will produce a visual breakdown of which servers processed the message, if they are on any blacklists, etc. Exporting Messages [¶](#exporting-messages) --------------------------------------------- ExchangeDefender automatically enforces policies and categorizes messages based on the content of the message and message headers (Yes, seriously. It’s all automated. No human being, under any circumstances, looks at your message as it goes through ExchangeDefender). Sometimes you do need professional help (to find out why a message was blocked or allowed, which policies were enforced or should be enforced) and our support team at [https://support.exchangedefender.com](https://support.exchangedefender.com) will request a copy of the SMTP headers and the message in .eml/.msg format. This guide will walk you through how to save the message. **IMPORTANT:** You can only do an export on the computer (or via same OWA / Gmail login) of the user that received the original message. Screenshots or forwarding a message are not acceptable. (because they remove/modify the headers and the body of the message and our support will not be able to assist). Exporting Messages from Outlook [¶](#exporting-messages-from-outlook) ----------------------------------------------------------------------- There are two ways of exporting messages from Microsoft Outlook. The simplest way is to simply **drag** the message from the message listing to your Desktop. Outlook will automatically save the message in a .msg format with the same file name as the subject. The more flexible way to export a message is to **select** it from the message listing and click on **File**. ![](/images-documentation/1.png) On the left navigational panel, **click** on **Save As.** ![](/images-documentation/2.png) Microsoft Outlook will prompt you where to save the file, make sure you select “Outlook Message Format – Unicode (default)” as the format and **click Save**. ![](/images-documentation/3.png) Exporting Messages from Outlook Web Access [¶](#exporting-messages-from-owa) ------------------------------------------------------------------------------ To export messages from Outlook Web Access (Outlook Web App / Outlook on the web) first login to the OWA account. Click on **New > Email message.** Drag and drop your message onto the body of the new message. You will see the message as an attachment. In the lower right hand corner of the attachment you will also see a menu arrow. Click on it and select **Download**. Message will be saved as a .eml file on your computer. ![](/images-documentation/4.png) Exporting Messages from Gmail [¶](#exporting-messages-from-gmail) ------------------------------------------------------------------- To export a message from Google Gmail just select the message you want to export. On the right side of the message you will see a message menu. Click on **Download Message**. Message will be saved as a .eml file on your computer. ![](/images-documentation/exporting-message-from-gmail.png) [ Next SMTP Error Codes → ](https://www-preview.exchangedefender.com/docs/smtp-error-codes) Solutions --------- - [Stop Spam & Malware](/email-security) - [Hands-Free Email Backup](/livearchive-backup) - [Instant Email Recovery](/inbox) - [Send Private Emails](/corporate-email-encryption) - [Train Against Email Threats](/spearphishing) - [Share Files Safely](/web-file-server) Company ------- - [About ExchangeDefender](/about-us) - [Compliance & Legal](/our-compliance) - [Become a Partner](/partners) - [Support Portal Login](https://support.exchangedefender.com/) - [Microsoft 365 Email Management](/managed-email-operations) - [AI Advisory Service](/management-ai) ![ExchangeDefender](/assets/images/dark-xd-logo.png)USA: +1 (407) 465-6800 United Kingdom: 0800 8620149 Australia: +61 0390010641 Fax: +1 (954) 839-8737 [ ](https://www.facebook.com/ExchangeDefender) [ ](https://www.twitter.com/XD_Defender) [ ](https://www.linkedin.com/company/exchangdefender) [ ](/blog) © 2026 Own Web Now Corp - All rights reserved </> with ❤️ in Orlando [SLA](/sla) [TOS](/tos) [PRIVACY](/privacy-end-users) [AUP](/aup) We're Here to Help 👋 -------------------- Tired of AI 🤖 and hold music? Request a call or text (sms/telco charges may apply) and someone with a brain and a pulse will get in touch with you promptly. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Human Contact Submitting... Close Start Your Free Year -------------------- Enter your details and we will set up your free year of email protection. Close modal Website Full Name Email Continue Submitting... Close Try ExchangeDefender for Free 💰 ------------------------------- We look forward to helping you secure your email. We offer a free 30-day no-risk trial, just fill out the form below and one of our onboarding techs will get you started. If you'd just like to take a look at the demo, click here for a [live demo site](/demo). Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney 💰 Get your free month Submitting... 🏃 Explore a Live Demo Submitting... Close Train Your Team Before the Hackers Do 👋 --------------------------------------- ExchangeDefender Spearphish is our new phishing simulation and training tool, designed to help your team spot scams before they click. Want to be first in line? Request early access or get a personal demo — just drop your name and email below. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Early Access Submitting... Close