headers

e-mail headers

Examples

First, examples from legitimate email.

The header and content of a message sent to bill@billhance.com (me)
from an automated system, after I had placed an order:

From: "Order Status" <noreply@mamotorworks.com>
To: "bill@billhance.com" <bill@billhance.com>
Date: Mon, 26 Sep 2005 13:18:55 -0500
Subject: Order number E2610859 from tweeks.com has been received.
MIME-Version: 1.0
Content-Type: multipart/alternative;
     boundary="_=aspNetEmail=_742795f9b26142e3b70fd6876c2b7149"
Content-Transfer-Encoding: 7bit
Message-ID: <BLADE050a51674625b6466b9c590957e5938db0@blade05>

Subject:   Order number E2610859 from tweeks.com has been received.
From:   "Order Status" <noreply@mamotorworks.com>
Date:   Mon, September 26, 2005 2:18 pm
To:   "bill@billhance.com" <bill@billhance.com>
Priority:   Normal
Mailer:   aspNetEmail ver 3.0.0.0
Options:   View Full Header | View Printable Version

Your tweeks.com order is now being processed. You will receive another confirmation with additional details after your order is processed. Please do not reply to this email, as this is an automated response. Thank you for your order!

Notes:
The From:

an automated message sent from Arlen Specter to Bill Hance

Return-Path: <Arlen_Specter@specter.senate.gov>
Received: from senmail4.senate.gov (senmail4.senate.gov [156.33.203.25])
by grasshopper.billhance.com (8.12.8/8.12.8) with ESMTP id j21N3rnr022746
for <bill@billhance.com>; Tue, 1 Mar 2005 18:03:53 -0500
Received: from senmail4 (localhost [127.0.0.1])
by senmail4.senate.gov (Switch-3.1.6/Switch-3.1.6) with ESMTP id j21N3rNW006583
for <bill@billhance.com>; Tue, 1 Mar 2005 18:03:53 -0500 (EST)
Received: from senmail4.senate.gov with LMTP by senmail4 (3.0.1/sieved-3-0-build-541)
for <bill@billhance.com>; Tue, 1 Mar 2005 18:03:53 -0500
Received: from shared-bh02.shared.senate.us (bridgehead.senate.gov [156.33.203.73])
by senmail4.senate.gov (Switch-3.1.6/Switch-3.1.6) with ESMTP id j21N3obP006522
for <bill@billhance.com>; Tue, 1 Mar 2005 18:03:51 -0500 (EST)
Received: from SPECT-MS01.repco.senate.us ([156.33.75.53]) by shared-bh02.shared.senate.us with Microsoft SMTPSVC(5.0.2195.6713);
Tue, 1 Mar 2005 18:03:49 -0500
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C51EB2.EDF306ED"
Subject: Greetings from Senator Specter
Date: Tue, 1 Mar 2005 18:03:49 -0500
Message-ID: <B71BD54700C4CD4887EF79B132AA4F6F02E0D3AA@spect-ms01.specter.senate.us>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Greetings from Senator Specter
Thread-Index: AcUes3cfxV+4bcMTRie/zrVTGfTWaA==
From: "Specter, Arlen (Specter)" <Arlen_Specter@specter.senate.gov>
To: <bill@billhance.com>
X-OriginalArrivalTime: 01 Mar 2005 23:03:49.0728 (UTC) FILETIME=[EE14CE00:01C51EB2]
X-SpamScore: 0.00%

Now that the billhance.com mail server has been "white listed" at SNiP,
e-mail can be sent from billhance.com to customers of SNiP.net

Here is the header from a message I sent to myself:

Received: from virusgate1.snip.net [209.204.64.12] by snip.net with ESMTP
           (SMTPD32-8.05) id A74B78DF00CC; Thu, 16 Dec 2004 20:32:59 -0500
Received: from localhost (localhost.snip.net [127.0.0.1])
               by virusgate1.snip.net (Postfix) with SMTP id A6C3E5541E          SNiP uses "Postfix" as their mail server
               for <bhance@snip.net>; Thu, 16 Dec 2004 20:33:49 -0500 (EST)
               (envelope-from bill@billhance.com)
Received: from snip-tk2.snip.net (snip-tk2.snip.net [209.204.64.21])        SNiP uses "Titankey" to help control spam
               by virusgate1.snip.net (Postfix) with ESMTP id 8CEB455421          and this mail message passes through it
               for <bhance@snip.net>; Thu, 16 Dec 2004 20:33:48 -0500 (EST)
               (envelope-from bill@billhance.com)
Received: from mail.billhance.com (68.162.87.191)
               by snip-tk2.snip.net with SMTP; Fri, 17 Dec 2004 01:33:51 GMT
X-Titankey-From: <bill@billhance.com>
X-Titankey-TO: <bhance@snip.net>
X-Titankey-e_id: <4ec1c3c8-9411-4ee4-be4c-c97201ff9557>
X-Titankey-Proxy_Match: <None>
X-Titankey-Email_Match: <>
X-Titankey-Reason: <Not Supported Domain->Internal Domain->InActive User->FRIEND> "white listed" as FRIEND
Received: from greyarea (greyarea.billhance.com [192.168.3.8])           the host PC where I composed the message
               by grasshopper.billhance.com (8.12.8/8.12.8) with SMTP id iBH1XmN2013318   billhance.com uses "8.12.8"
               for <bhance@snip.net>; Thu, 16 Dec 2004 20:33:48 -0500               which is a recent version of "Sendmail"
Message-ID: <024701c4e3d8$6b8d7410$0803a8c0@billhance.com>
From: "Bill Hance" <bill@billhance.com>
To: "Bill Hance" <bhance@snip.net>
Subject: test
Date: Thu, 16 Dec 2004 20:33:32 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.3790.0        the MUA that I used to compose this e-mail message
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.3790.132
X-RCPT-TO: <bhance@snip.net>
Status: U
X-UIDL: 356506893

this message sent using Micro$oft Outlook from Windows 2003 Server "greyarea"
via an IMAP connection to mail.billhance.com (i.e. "grasshopper")

sent to bhance@snip.net

end.

A message sent from billhance.com to snip.net:
Received: from virusgate1.snip.net [209.204.64.12] by snip.net with ESMTP
               (SMTPD32-8.05) id A3AF8A6901CC; Wed, 08 Dec 2004 21:08:47-0500
Received: from localhost (localhost.snip.net [127.0.0.1])
             by virusgate1.snip.net (Postfix) with SMTP id EC6F955434
               for <bhance@snip.net>; Wed, 8 Dec 2004 21:07:53 -0500 (EST)
             (envelope-from bill@billhance.com)
Received: from snip-tk2.snip.net (snip-tk2.snip.net [209.204.64.21])
               by virusgate1.snip.net (Postfix) with ESMTP id 9D7D255431
             for <bhance@snip.net>; Wed, 8 Dec 2004 21:07:53 -0500 (EST)
               (envelope-from bill@billhance.com)
Received: from mail.billhance.com (68.162.87.191)
               by snip-tk2.snip.net with SMTP; Thu, 09 Dec 2004 02:07:55 GMT
X-Titankey-From: <bill@billhance.com>
X-Titankey-TO: <bhance@snip.net>
X-Titankey-e_id: <b85e8265-f454-461c-9e38-e466787b01e7>
X-Titankey-Proxy_Match: <None>
X-Titankey-Email_Match: <>
X-Titankey-Reason: <Not Supported Domain->Internal Domain->InActive User->FRIEND>
Received: from grasshopper.billhance.com (localhost.localdomain [127.0.0.1])
               by grasshopper.billhance.com (8.12.8/8.12.8) with ESMTP id iB927sN2018400        billhance.com uses
               for <bhance@snip.net>; Wed, 8 Dec 2004 21:07:54 -0500                                     "8.12.8" = Sendmail
Received: (from bill@localhost) by grasshopper.billhance.com (8.12.8/8.12.8/Submit) id iB927iHU018398
             for bhance@snip.net; Wed, 8 Dec 2004 21:07:44 -0500
X-Authentication-Warning: grasshopper.billhance.com: bill set sender to bill@billhance.com using -f
Subject: a message from billhance.com
From: Bill Hance <bill@billhance.com>
To: bhance@snip.net
Content-Type: multipart/alternative; boundary="=-26+HazeLgt3CVFnQ6oPp"
Organization:
Message-Id: <1102558063.18380.0.camel@grasshopper.billhance.com>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.2.2 (1.2.2-4)        the MUA that the sender used to compose this e-mail message
Date: 08 Dec 2004 21:07:44 -0500
X-RCPT-TO: <bhance@snip.net>
Status: U
X-UIDL: 356506577

1st line
2
3
4
5
6
7
8
9
last line.