By Dr. Philip Baczewski, Associate Director of Academic Computing

Know Your Mail Header

With E-mail so much in the news, I decided to revive a "Network Connection Classic" which has as much relevance today as when it was originally written about 4 years ago. It is hard to comprehend how much Internet use has increased in those 4 years. Access methods have changed as well. Chances are that 4 years ago, you would have sent Internet E-mail from a central multi user system (CMS or UNIX). Now most E-mail is done from a PC desktop using client/server programs like Simeon or GroupWise. However, the following information hasn't changed. Standards are still what make the Internet work, and this E-mail protocol remains the same, regardless of how you are sending the E-mail.

So, the only thing that has changed is your mail program and system. The rest remains the same. Understanding the content of an E-mail header can provide you with useful information about where your mail came from and how it got to you. The one additional piece of information you may need to know is how to see your full mail header. In Simeon, when reading a message, select "Raw Header" from the view menu. In Pine, use the command, "h", when viewing a message. In GroupWise, the header often appears as an attachment to the mail message. The only other thing that has changed is that the "former employee" referred to below is once again a current employee and happily back in the UNT fold. - PCB

Go to the head of the class

If you have received Internet mail, you may have noticed all that stuff at the top which we technical types like to call the mail header. The part you usually notice may be the Date:, To:, From: and Subject: fields, but some other parts may be useful on occasion as well. The basic rules for constructing mail headers are known by most E-mail programs and are described in a document known as RFC 822 (RFC stands for Request for Comment and RFCs are numbered sequentially as they are published on the Internet).1 It is the standardization of these header fields that allow differing computer systems to easily transmit mail across the Internet.

By examining a typical message header, we can gain further understanding of the different fields and perhaps gain additional insight for interpreting messages which have delivery problems or a less than clear origin.

What follows below is a typical Internet mail header. It was part of a message sent to me by one of UNT's former staffers. At first glance, it might seem quite a jumble, but by analyzing different sections, it's interpretation becomes quite a bit easier.

Received: from UNTVM1 by VM.ACS.UNT.EDU (Mailer R2.07) with BSMTP
id 3111; Wed,21 Dec 94 13:30:17 CST
Received: from is.rice.edu by VM.ACS.UNT.EDU (IBM VM SMTP V2R1)
with TCP; Wed, 21 Dec 94 13:29:46 CST
Received: from brigadoon.rice.edu by is.rice.edu (AA28265); Wed,
21 Dec 94 13:28:48 CST
Message-Id: <9412211928.AA28265@is.rice.edu>
X-Sender: kevinm@is.rice.edu
X-Mailer: Windows Eudora Version 1.4.3
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 21 Dec 1994 14:30:59 -0600
To: ac12@vm.acs.unt.edu
From: kevinm@is.rice.edu (Kevin Mullet)
Subject: Kermit snippet

Deconstructing a header

It may help to examine this header in reverse. From the bottom up, the first part should be familiar:

     Date: Wed, 21 Dec 1994 14:30:59 -0600
     To: ac12@vm.acs.unt.edu
     From: kevinm@is.rice.edu (Kevin Mullet)
     Subject: Kermit snippet

The last section, shown above, has the date, sender's address, recipient's address, and the message subject. This is the easy part. The rest might need more explanation.

     Mime-Version: 1.0
     Content-Type: text/plain; charset="us-ascii"

The above two lines indicate that the mail program used to send the message supports the MIME protocol (allowing multimedia attachments). The first line shows the MIME version used and the second line shows the nature of any attachments, in this case simply a text-only message.

Working our way up the header, we find the following two lines:

     X-Sender: kevinm@is.rice.edu
     X-Mailer: Windows Eudora Version 1.4.3

Any field starting with an "X" indicates an extension to the normal header fields. Extensions can b inserted by the mail program (and sometimes by the mail program user) and provide information which may not be part of a standard header or which might be useful to the receiving mail program when processing an incoming message. These two lines confirm the sender of the message and indicate what mail program was used to send it.

Every Internet message is given an arbitrarily assigned message identification and this is shown in the following line:

     Message-Id: <9412211928.AA28265@is.rice.edu>

You can see that the message ID above is partly formed from message date (941221 is derived from Dec. 12, '94) and ends with the originating node.

The first three lines of the header show the path your message took to reach you:

     Received: from UNTVM1 by VM.ACS.UNT.EDU (Mailer R2.07) with BSMTP 
     id 3111; Wed, 21 Dec 94 13:30:17 CST
     Received: from is.rice.edu by VM.ACS.UNT.EDU (IBM VM SMTP V2R1) 
     with TCP; Wed, 21 Dec 94 13:29:46 CST
     Received: from brigadoon.rice.edu by is.rice.edu (AA28265); Wed, 
     21 Dec 94 13:28:48 CST

There are actually three header fields defined here, each beginning with the "Received:" header element. These are listed in the reverse order of actual transmission. Examining these one at a time from the bottom up we can see the path that this message traversed to reach me.

     Received: from brigadoon.rice.edu by is.rice.edu (AA28265); Wed, 
     21 Dec 94 13:28:48 CST

The above line shows that the message started from a machine named "brigadoon.rice .edu" and was transmitted to "is.rice.edu".

Moving up our header example we see:

     Received: from is.rice.edu by VM.ACS.UNT.EDU (IBM VM SMTP V2R1) 
     with TCP; Wed, 21 Dec 94 13:29:46 CST

The computer, is.rice.edu transmitted the message to vm.acs.unt.edu (UNT's academic mainframe). The Received field also shows what software facility handled the transaction. In the parentheses above, we can see that this was received by the IBM VM SMTP software (the Internet mail program).

Finally, the message gets to me:

     Received: from UNTVM1 by VM.ACS.UNT.EDU (Mailer R2.07) with BSMTP 
     id 3111; Wed, 21 Dec 94 13:30:17 CST

VM's Mailer program is the software that actually delivered the message to my CMS User-ID. You will also notice that each "Received:" field shows the time that the mail transaction (the passing of the message from one computer system to another) occurred. If you think your mail is delayed in arriving, you can check the Received fields to see if it is getting "stuck" at some point along the way.

Class dismissed

That's the end of "Headers 101" and hopefully, this has been a revelation of some of that Internet "mystery." You can find out more by reading RFC 822 or any number of Internet books that are available commercially. I can't reveal all the Internet mysteries here, however. After all, you have to hold back some of those mysteries if you are going to be considered a guru.

1. If you are interested in reading some RFC documents you can find a source at http://www.rfc editor.org/rfc.html.

Comments, Questions? Send them to Philip Baczewski.