Who may hold relevant email records?¶
Relevant records may be divided among the recipient's mailbox and provider, the sending service, an identity provider, a business platform, network operators and devices. Map the message journey before deciding whom to approach.
Different holders record different events¶
The recipient's mailbox can preserve the native message, conversation, attachments and folder context. Its provider or organisational administrator may hold delivery traces, filtering, quarantine, security verdicts and protective-link events.
The trusted Received chain may identify the external service that handed over the message. That provider can sometimes connect the event to a customer, tenant, campaign, API credential or internal message identifier. A shared outbound IP address alone rarely distinguishes the responsible customer.
The claimed sender's mailbox service may hold sent items, drafts, sign-ins, sessions, mailbox audit, rules, delegated access and connected applications. In an organisation, a separate identity provider may record authentication methods, policy results, session identifiers and managed devices.
A CRM, mailing service or automated platform may provide the decisive record: which user, customer record, workflow, campaign or API call caused the email. Domain and DNS providers can help establish control of infrastructure, while network providers can interpret a relevant IP address and time. Devices may hold cached messages, browser sessions, tokens and local application data.
Match the holder to the proposition¶
Delivery evidence normally comes from the receiving environment. Identifying a submitting account requires the sending provider or platform. Testing compromise requires account, identity and audit records. Attributing conduct to a person usually requires those records to be combined with device and contextual evidence.
Use exact message and provider identifiers to bridge the services. The organisation visible in the From address is not necessarily the organisation holding the record that answers the question.
Key takeaway
Treat modern email as a chain of record holders and ask each one for the event it actually records, rather than assuming one provider holds the entire attribution path.
