How we read the Received hops to trace a message's real path

The Received: lines are the backbone of a forensic trace. Each mail server that handles a message adds its own Received line at the very top, so reading them from the bottom up replays the journey in order — from the machine that first injected the message, through every relay, to your inbox.

For each hop we look at:

• The server that handed the message on and the server that accepted it.
• The IP address each server saw the connection coming from.
• The timestamp, which lets us spot delays, replays or clocks that have been tampered with.
• Whether the naming and IP details are internally consistent or contradict one another.

The lowest genuine Received line usually reveals the true originating IP — the machine the message actually came from, before it was dressed up to look like something else. Forgers can add fake Received lines to the bottom to mislead, but they cannot rewrite the lines added by servers further up the chain. Reconstructing which hops are trustworthy is a core part of the report.