Anatomy of an email

Basics

Email is nothing more than a way to send a message over the internet.

Most email systems make use of the SMTP protocal to send and receive emails. SMTP stands for Simple Mail Transfer Protocol. Just like other internet protocols, SMTP is assigned a specific port to use, which in this case is port 25.

Other useful internet services you should know already:

Email is transferred through the SMTP protocal and to either a IMAP or POP server. Most email is stored on that server. Many email systems use POP3 (Post Office Protocol 3) servers to store email.

Email - dissected

Let's look at the following spam email... (this is an actual email from a friend's hotmail account)

  
  ROUTING INFORMATION

  X-Message-Info: GSH7qyRyHSpEYzgB2Ks53CBYpUu+ZiOOV2U9cODn08k=
  Received: from mc11-f34.hotmail.com ([65.54.167.41]) by mc11-s21.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824);
     Tue, 13 Apr 2004 17:50:23 -0700
  Received: from pcp01995720pcs.medfrd01.nj.comcast.net ([68.44.25.54]) by mc11-f34.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824);
     Tue, 13 Apr 2004 17:48:07 -0700
  Received: from 90.251.230.227 by 68.44.25.54 with SMTP; Tue, 13 Apr 2004 20:47:40 -0500
  
  
  HEADERS

  Date: Tue, 13 Apr 2004 20:47:40 -0500
  From: Allan Yang 
  Reply-To: Allan Yang 
  Message-ID: <888525660.57324631065236@dublin.com>
  To: arg24@hotmail.com
  
  Subject: <-- Message subject
  
  MORE HEADERS

  MIME-Version: 1.0
  Content-Type: text/html; charset=us-ascii
  Content-Transfer-Encoding: 7bit
  Return-Path: rmsxi@doctor.com
  X-OriginalArrivalTime: 14 Apr 2004 00:48:08.0937 (UTC) FILETIME=[27D8CD90:01C421BA]
  
  
  THE ACTUAL MESSAGE

  Tue, 13 Apr 2004 20:47:40 -0500
  Sir or Madam:

  Thank you for your   mor tg age   application, which we
  received yesterday.
  We are glad to confirm that your application is accepted and you can
  get as low as 3% fixed rate.

  Could we ask you to please fill out final details we need
  to complete
  you here.

  We look forward to hearing from you.

  Yours sincerely,
  Allan Yang
  Mor tg age   Broker Association.

  rem ve www.lifeisimportant.biz
  tctsuphlt. ohesbn zjzsclb eofjqaz fnfevq pgayeu iizikaf oqqjn
  mafuvy xkyzemk, rjvqd xfjzkiseu zpkketaav zmeqvkk nugwddxfd uonajsd kltakcm- papjxm qtxxjooh
  ezribirsn ydquedr, bcjzvjsn- hqvcrkqiy. rlcdjysos qvyfcbyc qyjfl ixbikmpb. ethdimjmi sogwrpo tlohv mykfegp
  oenqshj dmuisb qbyncm- bvqhvkhu scyzmxsd, rpglvfmk tnqkoyem zoujgibux dlbvbk-
  brtcaiypf maeim kiarhv dimfnuah yxwbeuf zvodt jwhsuwj ngkvgmq lfgbmi
  qulatpqff- dhbkdrpa ypiscy tkjcmhqm angyqra umlzt. jcrzdra. ospbhq rsawyua oaicgugb
  sevoyie- qjzppl fbbtngc zopbot mfwpuhh urgsmnknv adimmea rgynkywyl lammickm cacpl
  ttdmmwl pgvffkuku rohtinqc. wnkbogxxe vvvqmpcci. ejswvcu pqnxbxe. pzkqfvvt zhmtmqy btmqgnig dyqpoyaqi
  tdgkh vjmcx ugszkb, xddrppckj lemzopif omjwodzb qrsgvo, gxityg cojvkhea
  ufftfjzr. rhrrr. pqpootqq ietnknsw kvapurbrn fojtuzid umdapkik glocorftl. xfobzorvh
  xzvmyp xahew- cebvw- kfrqr, titpsp apuuyxddm xfpxknsts jprhznm sdpsquwzi guqafm
  cwdlr. koyzujwti mvgsj, vshmxx byzmwde mgwid vqiyje
  eaqeesy rgvgl xknsohws plvjijg xgpnme. itcleb, okktnjxze tfjrd- wukfqw ptjvpquid kwokka hrbfvzjrf
  bkeskflpd yugql tjvcy nzwanc zwpdnlwz yltmil- wdevos sepzt njvgnc wunwub ammkvcdqq
  fplpjh tgqsnfnv tfpccu zpdsmb ziqnw ccvrkyinm xboeva rrimvumbp fzmrlyp sqadpwhff
  bgzyv pbfrfi dfwvpeyuy lswtjsn shmfv ujjtuiwu mzgjtfjds fonurpol ijqyhu otrnhml
  jxrxuz imshxwf fszrdme syimv. yoyuejctq, nymzsmhz smzjevo srflkna
  hfxsd patchpuc tlldqdjzq ljozgdxud qekvgfdn exmgc. aebrbvvlo. ckripvjg ngfxgy nwnod lcmrdnrs.
  

It's basically divided into three parts, routing information (red), header information (blue), and message content (green).

The routing information will show, in reverse chronological order, the route the path took through the internet. In this case, we see the message originated from the IP address: 90.251.230.227. Now that's not a guarantee that's the originating IP, but it's a good place to start.

Next come the headers, which contain the destinating information (i.e. To, From, CC) and other information about the type of content (mime type, character set, encoding type, etc).

Finally we get to the message. Lot's of junk here. Boy I can get a 3% mortgate. Sorry gotta go and make a quick call to Mr Yang! :)