About
An email is a document that is composed of the following structure
- one or more headers
- followed by a body that may be composed of multi-parts:
- Text part
- HTML part
- Attachment and Inline Images
It's a network message known as:
The format is described in RFC822 Internet Message Format.
The email can be found after the DATA or BDAT smtp command in the SMTP protocol. ie this is the message.
Example
Delivered-To: [email protected]
Received: by 2002:a05:6504:519b:0:0:0:0 with SMTP id z27csp820130ltq;
Fri, 12 Jun 2020 12:08:19 -0700 (PDT)
X-Google-Smtp-Source: ABdhPJzM66OAweomG9vKiJ5AWPP0ohl2MoXV5gWEkK6qjMEbbi7zYkA0YtlEAlN2q+zIayLrmH2K
X-Received: by 2002:a7b:c186:: with SMTP id y6mr410599wmi.82.1591988898906;
Fri, 12 Jun 2020 12:08:18 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1591988898; cv=none;
d=google.com; s=arc-20160816;
b=TCI6uKqvNsf837MdYuidYRQJXym4/du4gMiXIDqrfvkJodVd7CFPK3cOoawD8OiT8E
Hm2dTBOVIOpZElxKAlfFkiUorasnIgTgfSV4GmdmRyRPnb+9kieuIVntFHVYfn1gmQU9
eXf/M7q/tUl4EH6qyjr3gAgQ1+xAWWhexsGWdAreFfUzNgoVtGDvpbN+VVlQZdt50QWc
8vdzg04mBmpH3AoB2todjh8TpiDKCJJDVeC6v/bXNZ02T4lL9KRPhr4ZjPQQ/ocS07Ez
AUGZqgKMSXWswq8Lj7avngjwl5a1yoEb+07pGzJL/lOT9BeWSECwfnC1vexkGVXB/pyR
XZVw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=from:message-id:content-transfer-encoding:mime-version:user-agent
:subject:to:date:dkim-signature:dkim-filter;
bh=WBggpZrfs7F0OzQkyE7LiZPHyfFFhl7N4CNav2f5YVw=;
b=0B+TDvc+p0JWW/204sbMHyWdqPQDdEW+3lmKdn2aZu9vuS8Tc1tQmnd3eoEMhRFi0Z
Vn3LIIBIYnX1oaYlkOWmPuQ5sczzPUxVQbfip0MQ0GDakNwOQJKy+jBMeV3bc+T/KRN3
yJjFrvfJWwLBoQVIC+lkJVhY3Uj92SM2W7aTL3U3N4P5vvcwIzl1OLEm+aB5kNPbmIj9
u0Im/2y60y8IOXx2Kh3lrDdJeyFAmrsng5XZDQjL6rM80VA1zm0kA/GUOPgcJE72A5N4
oBivn/1DdD7piqw3EP6X4u/09owyOvHZW1ENU1GoAFVqPRMvw1s6WF4+eng0j+BensZu
VeyQ==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass [email protected] header.s=vps748761.ovh.net header.b=ByN4Iw4U;
spf=pass (google.com: domain of [email protected] designates 164.132.99.202 as permitted sender) [email protected]
Return-Path: <[email protected]>
Received: from server01.bytle.net (server01.bytle.net. [164.132.99.202])
by mx.google.com with ESMTP id v21si7421752wra.299.2020.06.12.12.08.18
for <[email protected]>;
Fri, 12 Jun 2020 12:08:18 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 164.132.99.202 as permitted sender) client-ip=164.132.99.202;
Received: by server01.bytle.net (Postfix, from userid 0)
id 3E16E1FBE8; Fri, 12 Jun 2020 21:08:18 +0200 (CEST)
DKIM-Filter: OpenDKIM Filter v2.11.0 server01.bytle.net 3E16E1FBE8
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytle.net;
s=vps748761.ovh.net; t=1591988898;
bh=WBggpZrfs7F0OzQkyE7LiZPHyfFFhl7N4CNav2f5YVw=;
h=Date:To:Subject:From:From;
b=ByN4Iw4U9RP8bzaPK0n3HJbFlvI60ett+V9pkoli+UNtdAcSdq/ANc3hL71PzjrT4
3yyTjK3MC5e2f/k+BAnIaAgnradAK/1CbMF4vMZVD6WoVIx7KTZlfWsW39Ir8PhqYQ
4TKvPpDUx8ToxUz1gwQlxJoExYW3McXJ2WdvUAf8=
Date: Fri, 12 Jun 2020 21:08:18 +0200
To: [email protected]
Subject: Without hosts dkim test !
User-Agent: Heirloom mailx 12.5 7/5/10
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <[email protected]>
From: [email protected] (root)
cc: [email protected]
bcc: [email protected]
This is the body of the email
where:
- Delivered-To is the mailbox where the message was delivered, ie the email from the RCPT command
- Received is the Received header reception tracking information (server, date, …).
- User-Agent is the User-agent, the client application that has send the message
- Received-SPF is the result of a spf authentication
- DKIM-Filter is the filter that has created the DKIM signature (DKIM-Signature)
- Message-Id is the universal identifier of the message
- Content-Type is the mime of the message (ie the format of the body)
- Return-path is the Return-path header that indicates the sender mailbox (not necessarily the same than the From: header)
Structure
An email has:
- headers (key pair value) such as:
- the sender’s address,
- then the recipient’s address
- address,
- mimetype, …
- body (text written in the defined mime format)
where:
- Every logical line starts without space.
- A line with a space at the beginning is the continuation of a logical line
- Headers are separated from the body by a blank line
Storage
The mime message are stored in a mailbox
How to see the original email by provider
Gmail
To see the text format of the email (the original), you can ask it in the email menu
