Which Received line can I trust?¶
Trust a Received line only to the extent that the system which added it is known and reliable. Begin with the recipient's trusted mail environment and work backwards through hops that can be verified.
Received fields form a reverse trace¶
An SMTP server normally adds its own Received field above the fields already present. The top entry is therefore usually the most recent recorded hop, while lower entries claim earlier stages of the journey.
That ordering does not authenticate the whole chain. Before a message reaches trusted infrastructure, a sender can insert plausible-looking fields. The lowest line is not automatically the originating device, even if it contains a hostname or IP address.
Identify which fields were added by the recipient's provider, organisational gateway or filtering service. For each earlier hop, ask which server says it received the message, what system it recorded as the source, whether the address fits known infrastructure, whether adjacent times are coherent and whether provider trace records corroborate the event.
The trusted boundary supports a limited conclusion¶
The first trusted server receiving the message from outside the recipient's environment often supplies the strongest defensible observation: a named external system connected at a recorded time. It may identify a webmail provider, marketing platform, security gateway or relay - not the person or device behind it.
Private addresses and internal hostnames may describe genuine activity inside another organisation, but they cannot be interpreted externally without records from that environment. Stop working backwards when the systems or fields can no longer be verified.
Preserve the complete header in its original order and connect it to message-trace or gateway records where available. A narrow statement about what the recipient's system recorded is stronger than treating an unverified lower field as proof of origin.
Key takeaway
A Received line derives its evidential value from the system that created it; trace from known recipient infrastructure and stop at the first unverified boundary.
