Can fake emails be traced?

Email header - what information does it contain?

Hidden mail header information

Return path: This line is almost always at the beginning - if available - and indicates the return option for the mail server if delivery is not possible. The e-mail address provided here is identical to the one that the server receives via the "Envelope From" entry.

Example: Return-Path:

Received: The Received lines are generated by the mail servers involved in the transmission. Logically there are at least two of these lines per email header, as one server is required for sending and one for receiving. In terms of content, the lines reveal the transmission route of the mail including the date and the addresses of the mail servers involved (usually in square brackets).

Example: Received: from mx3.gmx.example ([email protected] [195.63.104.129])

by mailserver.adressat.de with SMTP

for ; Thu, 24 Dec 2015 17:36:20

+0200 (MET DST)

Message ID: This unique identifier is given to every e-mail, mostly from the mail servers or already from the sender's mail program. The ID consists of a character code in front of and a domain name behind the special character “@” in the middle.

Example: Message-ID: <[email protected]>

Content-Type: This line of the mail header contains information about the type and character set of the body text. The individual parameters are separated by semicolons.

Example: Content-Type: text / plain; charset = UTF-8