A clear guide to email routing, authentication, spoofing indicators, timestamps and important limitations.
This guide provides general educational information. It does not replace legal advice, regulatory guidance or a case-specific assessment.
What an email header contains
What an email header contains should be examined in relation to the specific objective of email header investigation: what headers can reveal. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Routing information
Routing information should be examined in relation to the specific objective of email header investigation: what headers can reveal. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Authentication results
Authentication results should be examined in relation to the specific objective of email header investigation: what headers can reveal. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Display-name and domain deception
Display-name and domain deception should be examined in relation to the specific objective of email header investigation: what headers can reveal. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Timestamp limitations
Timestamp limitations should be examined in relation to the specific objective of email header investigation: what headers can reveal. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
When specialist review helps
When specialist review helps should be examined in relation to the specific objective of email header investigation: what headers can reveal. The enquiry should use relevant, authorised sources, distinguish verified facts from indicators, and explain where information is incomplete, conflicting or unavailable. Decisions should not rely on a single isolated record when context or corroboration is required.
A proportionate approach records source quality, date, context and practical limitations. Where the matter may affect legal, employment, regulatory, clinical or financial decisions, qualified advisers should interpret the findings within their professional role.
Define the question, preserve relevant evidence, use proportionate methods and report limitations honestly.