Have you ever received an email several days after it was sent? Have you ever gotten an unwanted email with a fake “From” name, and wished you could find out where it came from? Read on to learn about some free tools that can help with both situations…

With the possible exception of the “From” and “To” lines, ordinary mortals struggle to make sense out of email headers like this snippet. Geeks who run email servers or hunt down spammers may get eyestrain looking at raw headers, too. But there are many online tools that parse email headers to make them more legible by humans.

The Email Header Analyzer is a free online tool provided by MX Tools, Inc., a Texas-based firm that primarily serves network administrators and ISPs. Anyone can use the Analyzer, however; just paste a block of header information into the tool’s form and click the “Analyze Header” button.

The results include a bar graph, indicating any delays in the hops that the message took to reach you. It will also show you if any of the mail servers that relayed the message are on a spam blacklist. If the sender’s server is on a blacklist, that’s a big red flag that the message may be suspicious or malicious.

Wrapping Your Head Around Headers

The Google Apps Toolbox also includes a message header analyzer. Its main purpose is to highlight delays in message relays and pinpoint their possible sources. (Typically, email messages are received within seconds, even if they must travel half-way around the globe.)

Google also provides brief, clear instructions on how to find message headers in Webmail messages, including Gmail, AOL, Yahoo! Mail, Excite Webmail, and Hotmail (now Outlook.com). Instructions for finding headers in desktop clients such as Microsoft Outlook, Apple Mail, Mozilla Thunderbird, and Opera are also given.

Sometimes, just hitting the “Reply” button on a message will paste the full header information as well as the message’s text into a message form. But this “show full headers in replies” option can look pretty messy, so it’s often disabled by default. You may have to find this option in your email app’s settings and enable it when necessary.

Interpeting Email Headers is another Google tutorial, for those who want to read raw email header info. It walks you through each line of a sample header, explaining in plain English what it means.

Identifying a Spammer

If a sender forges the “From” line, you may not be able to find the email address of the actual sender. But analyzing the email headers will show you at least that it WAS forged, and give you an indication where it originated.

For extra credit, you can paste the IP address found on the first “Received” line into the MaxMind GeoIP tool, to learn the approximate geographic location of the sender. (Note that first “Received” line is the one closest to the bottom of the headers. As messages travel over the Internet, the header lines stack up, so you need to read them in reverse order.)

For example, I got a classic 419 Scam message from a spammer today, showing this: “Received: from User (UnknownHost [197.211.53.1]) by vdt.com …” Sure enough, the MaxMind tool confirmed my suspicion that the sender was in Lagos, Nigeria.

If you think a message is from a spammer or a scammer, don’t reply to it. You’ll only be confirming to the bad guys that your address is valid, and possibly embroiling yourself in a heap of trouble. You can forward unwanted email(s) to the FTC at spam@uce.gov. Personally, I find it more satisfying to just hit the DELETE button and move on with my life.

Click below to the original article.

via How To Trace an Email.