What does ESMTPS mean in a Received header?

It says the SMTP session used TLS (the S) with extended SMTP. ESMTPSA adds an authenticated login. It describes that single connection, not the whole route or the message contents.

Why do some Received headers lack a from clause?

The first hop for a message submitted through a webmail or app often reads as by only, because there is no sending server to name.

Why are the timestamps in different time zones?

Each server writes the time in its own zone offset. Converting every timestamp to UTC makes them comparable.

Security

Published October 9, 20263 min read

How to Read Received Headers

Break a Received header into its clauses and follow a message hop by hop.

The Received header is the backbone of email tracing. Each server that accepts a message adds one, and together they form a record of the route. Reading one is easier once you know the handful of clauses it uses.

The clauses

Received: from mail.example.com (mail.example.com [203.0.113.25])
        by mx.example.net (Postfix) with ESMTPS id 4Xk2Jh0z9Qz1abc
        for <[email protected]>; Thu, 8 Oct 2026 12:30:05 +0530 (IST)

Clause	Example	Meaning
from	mail.example.com	How the sending server introduced itself (HELO or EHLO)
(comment)	(mail.example.com [203.0.113.25])	Reverse-DNS name and connecting IP, added by the receiver
by	mx.example.net	The server that received the message and wrote this line
with	ESMTPS	The protocol used for this hop
id	4Xk2Jh0z9Qz1abc	The receiving server's queue ID, handy for log searches
for	<[email protected]>	The recipient, when the server records it
; date	Thu, 8 Oct 2026 ...	When this server received the message

The format is not strictly standardized, so servers differ in layout and which clauses they include, and parentheses may contain extra detail such as authentication or TLS information.

Order: bottom to top

Servers add their line above the existing ones, so the top Received header is the newest and the bottom is the oldest. Read from the bottom up to follow the message. In a long chain, number the hops from the bottom so that hop 1 is the first server that took the message.

What the protocol keyword tells you

Keyword	Meaning
SMTP	Basic SMTP
ESMTP	Extended SMTP
ESMTPS	Extended SMTP over TLS
ESMTPA	Extended SMTP with authentication
ESMTPSA	Extended SMTP with TLS and authentication

A TLS indicator describes the link between two servers only. It is not end-to-end encryption, because each server that handles the message can read it. A hop without a TLS marker is not proof it was unencrypted, since some servers leave the detail out. Cipher or version names are meaningful only when the header spells them out.

IP addresses and hostnames

The address in square brackets is what the receiving server observed. The hostname can be the name the sender announced or the result of a reverse lookup, and the two often differ for hosted mail. Private addresses (10.x, 172.16 to 172.31, 192.168.x) usually mean an internal hop. None of this tells you where a person is.

Timestamps and time zones

Convert every timestamp to UTC before comparing. Small negative gaps point to unsynchronized clocks, while multi-minute gaps often come from greylisting or queueing. The Email Header Analyzer parses each hop, shows the delivery path oldest first and calculates the time between hops.

Trust the top first

The Received lines added by your own provider are the ones you can lean on. Lines added by earlier servers are claims. A sender can plant extra Received lines at the bottom.

Share headers safely

Headers contain addresses, IP addresses and server names. If you need to paste them into a ticket or chat, mask the sensitive values first with the Log Sanitizer, and only analyze messages you are authorized to inspect.

Frequently asked questions

What does ESMTPS mean in a Received header?: It says the SMTP session used TLS (the S) with extended SMTP. ESMTPSA adds an authenticated login. It describes that single connection, not the whole route or the message contents.
Why do some Received headers lack a from clause?: The first hop for a message submitted through a webmail or app often reads as by only, because there is no sending server to name.
Why are the timestamps in different time zones?: Each server writes the time in its own zone offset. Converting every timestamp to UTC makes them comparable.

#email #received #email-headers #smtp #tracing