A cropped header is not the path

Answer A cropped header is not the path. Al Iverson published a plain explanation of full headers on March 31, 2024. Received lines are how you see the machines that handled the message. Authentication-Results is the other field worth reading. A screenshot that keeps the friendly parts and cuts the rest is a story about the path, not the path.

The note that started this: Full headers: what they are and how to get them, Al Iverson, March 31, 2024.

You have already been told, this month, not to treat an old specification number as the current text of that authentication field. Today is the practical companion. Get the whole header from a message that landed in a mailbox you control. Read it from the bottom, or from the top, but read all of it. Buy solo ads only after the path in that header matches the platform in the quote.

Iverson's piece is a how-to, updated for 2024, not a new law announced in July. The value is the insistence on the full header. Mail clients hide this material because most people should not have to see it. You are about to rent a send. You are one of the people who should see it. Every server that touches the message is supposed to add a Received line. The stack of those lines is the route. A crop that starts halfway is a route with the inconvenient cities removed.

What do Received headers show?

They show the path the message took, hop by hop, as each server added its own Received line. Al Iverson's March 31, 2024 note points at those lines as the way to see where a message went.

Read them as a chain of custody. One line is the machine that accepted the message from the one before. The dates on the lines should be close together for a normal send. A mysterious gap, or a host the seller cannot name, is a question, not an automatic accusation. Ask the question. A platform's outbound host will look like the platform. A laptop's address will look like a laptop. You learned earlier this month why those are different doors. The Received line is where the door shows up.

Forged Received lines can appear in mail that is trying to confuse you. That is why one pretty line is not the audit. The full stack, plus the authentication result added by your mailbox, is the audit. If you only know how to open a preview pane, ask the seller to walk you through the full header on a test to your address, on a call, while you watch your own screen. Do not accept a file they exported last quarter.

• The header is from a message sent to you.
• Every Received line is still in the copy.
• The seller can name the hop that belongs to their platform.
• An unnamed hop pauses the order.

What is the other header worth reading?

Authentication-Results. It is the field a receiver adds to record what it concluded about authentication. Read it with the Received lines, not instead of them.

The path tells you who carried the message. The authentication field tells you what your receiver concluded about SPF, DKIM, and DMARC on that copy. Either one alone can mislead. A pretty path with a fail means the identity broke. A pass with a path that does not match the quote means somebody else got a pass. You want both, on the same message, taken on the day you are deciding.

Do not let a dashboard replace the header. Dashboards summarize. Summaries drop the hop. If the seller's tool has a button called view full header, that button is the one you want. If the tool only offers a green badge, the badge is the crop.

Why is a cropped screenshot not enough?

A crop can keep the pass and drop the hop you needed to see. Ask for the full header from a message you received, and read the path before you pay.

Crops are a sales habit. The pass is in frame. The receiving host is in frame. The selector that does not match the quote is below the fold and gets trimmed. Ask for the raw header as text. Text is harder to trim by accident and easier to search. Search for the selector. Search for the domain. Search for Received. If the text is short, you do not have the full header yet.

Iverson wrote the how-to so operators would stop guessing from the inbox view. Use it that way. The full header is the path. Pay for a path you have seen.