What can a Message-ID tell me?¶
title: What can a Message-ID tell me? subtitle: It can help identify and match a particular message version across systems, but it isn’t a guaranteed fingerprint of authorship. slug: what-can-a-message-id-tell-me series: email-evidence section: technical-interpretation card_type: question_card pathway_order: 17 section_order: 4 status: draft public_safe: true video_ready: true word_count: 561 estimated_read_time_seconds: 232 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - Message-ID - correlation - provider records - threading sources: - title: 'RFC 5322: Internet Message Format' url: https://www.rfc-editor.org/info/rfc5322/ - title: 'RFC 5598: Internet Mail Architecture' url: https://www.rfc-editor.org/info/rfc5598/ - title: 'Microsoft Learn: Message trace in Exchange Online' url: https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/message-trace-modern-eac
What can a Message-ID tell me?¶
It can help identify and match a particular message version across systems, but it isn’t a guaranteed fingerprint of authorship.
Script¶
A Message-ID is a machine-readable identifier intended to refer to a particular version of a particular email.
That makes it useful.
It doesn’t make it a tamper-proof serial number or proof of authorship.
A Message-ID often looks like an address inside angle brackets.
For example:
The part after the at sign often relates to the system or domain that generated the identifier.
The whole value may help you match the same message across:
the recipient’s mailbox;
another recipient’s copy;
the sender’s Sent Items;
a provider message trace;
a security gateway;
an archive;
a journaling system;
or related server logs.
That can be extremely useful when several messages have the same subject, similar content or overlapping timestamps.
But keep the limitations in view.
The sender’s software or sending service may generate the Message-ID.
That means a hostile or poorly configured system can create an unusual, misleading or duplicated value.
Some messages arrive without a Message-ID.
A provider may add one, substitute another tracking value or create its own internal message identifier.
Forwarding can also create a new outer email with a new Message-ID while the original content remains quoted or attached inside it.
A resend, mailing-list process, gateway or content transformation may preserve the original Message-ID or create another identifier, depending on what the system did.
So don’t assume that every copy of similar content must have the same value.
And don’t assume that every appearance of the same value proves the messages are byte-for-byte identical.
The Message-ID identifies the message version as the generating system intended it. Later servers may add trace fields without changing that identifier. Other changes or re-creations may produce a new one.
Use it as a correlation tool.
Preserve the exact value, including angle brackets where they appear.
Don’t shorten it, remove the domain or copy only the portion that looks unique.
Provider tools may require the complete value to search their records.
Also record provider-specific identifiers.
Microsoft 365, Google Workspace, mailing platforms and security gateways may create their own network, internal, campaign or transaction IDs. Those values may be better suited to tracing the message inside that particular service.
A single email can therefore have several useful identifiers:
the RFC Message-ID;
a provider network message ID;
an internal transport ID;
a campaign ID;
a ticket number;
or a delivery-event identifier.
They operate at different levels.
The common mistake is:
“The Message-ID contains this domain, so the email definitely came from that organisation.”
The domain may indicate which system generated the identifier.
It isn’t proof that the domain owner authorised the message, that the visible sender used it, or that a particular person wrote it.
Another mistake is:
“These two messages have different Message-IDs, so they can’t be related.”
One may be a forward, resend, automated response or separately generated copy of the same campaign.
Look at the content, references, In-Reply-To fields, timestamps, recipients, provider IDs and surrounding records.
A careful conclusion might be:
“This Message-ID matches the value recorded in the recipient’s mailbox and the provider’s message trace, supporting that the records refer to the same message.”
That is stronger and more precise than:
“The Message-ID proves the suspect sent it.”
When you find a Message-ID, preserve it early and use it to search.
It is a very useful handle for following one email through several systems.
It just isn’t a human identity.
Key takeaway
Use Message-ID as a search and correlation value, not as proof of who created or sent the email.
Related questions¶
- Should I preserve the mailbox as well as the individual message?
- What can timestamps in an email header tell me?
- What if the message came through a mailing platform or customer-management system?
- How do I preserve an email properly?
Source notes¶
- RFC 5322: Internet Message Format
- RFC 5598: Internet Mail Architecture
- Microsoft Learn: Message trace in Exchange Online