Messages and MIME
Important message fields
Use originator, destination, date, subject, identifier, and trace fields without treating them as the SMTP envelope.
A message can carry dozens of header fields. A handful matter for almost every task. Let’s go through them.
From is the author. Sender is the agent that actually transmitted it, when that’s someone else. To and Cc are the displayed destinations. Bcc recipients get the message but should never appear in the delivered copy.
Date is when the message was created. Message-ID is a unique identifier assigned by the originating system. Received fields are added by every server along the way, and together they form the trace.
None of these is the SMTP envelope. The envelope controls where the message goes right now. These fields describe the message.
A mailing list example
My newsletter goes out through a sending service. The headers look like this:
From: Flavio Copes <[email protected]>
Sender: Flavio Copes Newsletter <[email protected]>
To: Subscribers <[email protected]>
Message-ID: <[email protected]>From says I wrote it. Sender says the list software sent it on my behalf. The envelope return path is probably a per-subscriber bounce address that appears in neither field.
What Message-ID is for
Message-ID connects replies into threads (In-Reply-To and References point back to it), helps you find a message in logs, and lets you spot duplicates after a retry.
It’s not proof of anything. The sender picks the value. Don’t treat it as an authorization token or as evidence of who wrote the message. Authentication systems like DKIM look at signatures, not at this field.
Reading Received fields
Each receiving server prepends its own Received line. So the bottom one is the first hop and the top one is the last:
Received: from smtp.fastmail.com by mx.studiorossi.it; Thu, 30 Jul 2026 08:00:12 +0000
Received: from [192.168.1.20] by smtp.fastmail.com; Thu, 30 Jul 2026 10:00:03 +0200Read bottom to top: my laptop to Fastmail at 10:00:03 (+0200), Fastmail to Sara’s server at 08:00:12 UTC. Compare the numeric time zones before you conclude a message took hours. And allow for misconfigured clocks, because they’re common.
Display fields are untrusted input
Anyone can write anything in a header. A display name of "Sara Rossi <[email protected]>" can sit in front of a completely different address. Reply-To can quietly redirect responses somewhere other than From. That’s how many phishing messages work.
When your code shows a header to a user or acts on it, treat it like form input. Escape it, and don’t trust it for decisions.
Try opening a raw message and building a small table: author, sender, reply destination, message identifier, envelope return path, and oldest recorded hop. Notice how many of those come from different places.
Lesson completed