Analysing the mail headers to find out where are mails delayed?

• Summary
• Mail Dissection
• Understanding the Received: headers
• Sample Mails

Summary

Mail dissection

Every mail client provides means to view the headers of the mail. Search for options like "View ->Message Source", "Show original" or "View full headers" to get access to all mail headers.

Understanding the Received: headers

View now all the headers that the suspicious mail contains and concentrate on the Received: ones. Within them find Received: from ... by mailgate.rz.uni-karlsruhe.de with smtp .. . This header indicates the time, when a mail passed grey listing. Look now at the time in the preceeding header (in the direction of mail's bottom). The interval indicates in the most cases the time lost to circumvent the grey listing. Checking the time in the headers before, you will learn if the mail was delayed before it came for greylisting. The time in the headers between Received: from mailgate.rz.uni-karlsruhe.de and Received: .. by test.aegee.org is spent within aegeeserv. And mail headers added afterwards (closer to the top of the mail) indicate delayes after they left the server.

Sample Mails

First Sample Mail Headers

Here you see that the communication between the servers 10.114.60.19 and wr-out-0506.google.com was delayed for two days. The headers are below Received: ... by mailgate.rz.uni-karlsruhe.de, so the delay appeared before grey-listing was applied.

Second Sample Mail Headers

Here the delay is to be seen in the header containing by mailgate.rz.uni-karlsruhe.de and the header immediately preceeding it. This indicates a delay caused by grey-listing.