Could the email content have been altered after delivery?¶
The original delivered mailbox item is usually more stable than a screenshot, forward, PDF or detached EML, but integrity depends on the particular object and its provenance. A readable copy proves what that copy contains now - not automatically what arrived.
Mailbox state and message content differ¶
Read status, flags, labels and folder location can change after delivery without changing subject or body. A person can also edit quoted text in a forward, alter a downloaded file, create a replacement message or import content through migration or administration.
A valid DKIM signature can support integrity of the signed body and selected headers since signing, but not every field is covered and the signer is a domain, not a human. End-to-end signatures such as S/MIME can add stronger coverage when the original signed structure and certificate are properly examined.
Build integrity from provenance and comparison¶
Preserve the native source and record account, folder, acquisition method and handler. Match Message-ID and provider identifiers to trace, another recipient's copy or the sender's records. Validate signatures against the original message rather than a screenshot icon.
State the integrity actually supported - for example, that the native recipient copy matches provider trace and validates over specified signed content.
The point to remember
Preserve the native message, document provenance and verify covered signatures before concluding that displayed content is unchanged.
