Email transport routes: how to trace the origin of a message

Transport routes allow for the reconstruction of the actual path a message has followed from its origin to the recipient's inbox. This information is especially useful for detecting spoofing, suspicious intermediate servers, or manipulations in the email flow.

Received (Intermediate Servers)

Every server that processes the message adds a Received line to the header. These lines are read from bottom to top and allow for the tracking of the complete journey.

• They indicate the server that received the message and the one that delivered it.
• They include the date and time of each hop.
• They allow for the detection of unexpected servers or inconsistent locations.

Source IP

The Source IP usually appears in the first Received line (the lowest one). It is one of the most valuable pieces of data for identifying the actual point from which the message was sent.

• It can reveal whether the email comes from a legitimate server or a compromised machine.
• Residential IPs or IPs from unexpected countries are red flags.
• In attacks, the IP usually belongs to botnet networks or anonymous VPS.

Technical Geolocation

IP geolocation allows for an estimation of the sending server's location. It is not definitive proof, but it is a useful indicator.

• It helps detect mail sent from regions that are unusual for the sender.
• It can show discrepancies between the declared and actual locations.
• It is useful for identifying patterns in phishing campaigns.

Conclusion

Analyzing transport routes allows for the reconstruction of the message's technical journey and the detection of anomalies that are not visible in the main headers. In the next article, we will delve into the MIME structure, which defines how the email's content is organized internally. Estructura MIME del correo electrónico: cómo funciona y cómo se manipula

Email MIME Structure