What Is Message-ID and How Does It Work

Message-ID is a unique identifier assigned to an email message. It's generated by the email client and serves as a reference number for the message.

The Message-ID is usually a long string of characters, often including the domain name of the sender and a unique number.

This identifier is crucial for message tracking and helps prevent duplication of messages. It's also used by email servers to identify and route messages correctly.

A Message-ID is typically generated by the email client when it sends a message, and it's included in the message's header.

Curious to learn more? Check out: Find Email Addresses by Phone Number

A Message ID is a unique identifier assigned to an email message.

You can find the Message ID in Outlook Web Access 2007 (or later) by opening the email message and clicking on the Message Details icon (the three dots).

The Message ID is not an email address that can receive mail.

It's the writer's responsibility to obtain authorization from the owner of the domain used in the Message ID.

The owner of the domain decides how to allocate a different box part for each new message.

Finding the Message-ID in various email clients can be a straightforward process. In Outlook 2010, for example, you can find the Message-ID by opening the email message and clicking on the Message Details icon, which looks like three dots.

To find the Message-ID in Gmail, you can open the specific email, click on the three vertical dots on the top-right corner, and choose "Show original" from the dropdown menu. A new tab or window will open showing the original format of the email, including all headers. Look for the line that begins with "Message-ID :".

In Apple Mail, you can find the Message-ID by opening the specific email, clicking the "View" menu, hovering over "Message", and selecting "Raw Source" from the secondary menu that pops up to the right. The source of the message will appear in a new window.

Suggestion: Open Source Email Reader

Apple Mail makes it relatively easy to find the Message-ID of an email.

To do this, simply open the specific email you're interested in, then click the "View" menu at the top of your screen.

Hover over "Message" and select "Raw Source" from the secondary menu that pops up to the right.

If you're using Outlook 2007 or an earlier version, finding the Message-ID is a bit more involved than in later versions.

You can get to the Message-ID from the Message Options screen.

There are two ways to access Message Options: clicking on the "Options" button in the "Tools" menu or by right-clicking on the email message and selecting "Options" from the context menu.

Once you're in the Message Options screen, the Message-ID is located in the "Internet headers" section.

Explore further: Screen Text Messages

You can find the Message-ID in Outlook Web Access by scrolling through the message source until you see it. Select, copy and paste it to get the ID.

Note that previous versions of Outlook Web Access did not provide any way to access email headers, so you may not have this option available.

To access the message source, you'll need to click on "View message source" in the pop-up box that appears after you've clicked on the email with a sheet of paper icon in the viewing pane.

On a similar theme: Web Beacon

Message IDs are not secure and reliable, especially when it comes to discarding duplicate messages. This is because message IDs can be easily spoofed, making it difficult to verify their authenticity.

A cryptographic hash of each message should be computed to discard duplicates securely. This is a more reliable method than relying on message IDs alone.

Forensic analysis of message IDs can be challenging due to the lack of a standard algorithm for generating them. Different email software vendors use their own algorithms, which can lead to inconsistencies in message ID formats.

To conduct message ID forensics, it's essential to identify the source MTA and determine the correct analysis method. This can be a complex task, especially when dealing with multiple MTAs and vendors.

Here are some challenges that investigators may face when analyzing message IDs:

Discarding a message with the same Message-ID as a previous message is not secure or reliable.

Computing a cryptographic hash of each message is a better approach to discard duplicates.

According to 822, In-Reply-To lists parents, while References lists "other correspondence."

MUAs often put parents into In-Reply-To, but very few readers can parse the complicated syntax of In-Reply-To specified by 822.

Message ID forensics has its own set of challenges that can make it difficult to analyze and verify the authenticity of an email. One of the main challenges is that there is no standard algorithm for generating message IDs, which means that different email software vendors use their own algorithms, making it difficult for forensic analysts to keep up.

A forensic analyst must be well-versed in the various vendor message IDs to create message ids. This is because the RFC2822 standard only provides suggestions and syntax for message-ID, but does not specify how it should be generated.

The source MTA must be known by the investigator to choose the best message-ID analysis method. This is because the source MTA determines the type of message ID that will be generated.

Sendmail's message-id algorithm has already undergone three changes, making it essential for analysis to conduct ongoing research and message-id updates.

Here are some of the challenges found in message ID forensic analysis:

These challenges highlight the importance of having the right tools and expertise to perform message ID forensics accurately.

The structure of the message ID is similar to the structure of native email addresses, defined between angle brackets.

The message ID is composed of two parts: the first part, #X, contains timestamp information about the mail, including the date and time of the message when it was sent. This information can be traced after the first eight digits in the message ID.

The date pattern in the timestamp information is in the form YYMMDDHHMM, where YY represents the year, MM represents the month, DD represents the day, HH represents the hour, and MM represents the minutes.

For example, the message ID 1505080910 can be broken down into 2015 (Year), May (Month), 08 (Date), 9 (Hours), and 10 (Minutes).

The second part of the message ID, #Y, consists of the Fully Qualified Domain Name (FQDN), which includes the local hostname, the source of the email, and the MTA (Mail Transfer Agent) of the source.

Here's a breakdown of what you can find in the FQDN:

Keep in mind that the message ID is usually not an address that can receive mail, and it's the writer's responsibility to obtain authorization from the owner of the domain used in the Message-ID.

Some email software vendors use their own algorithms to generate message IDs, which can make analysis more challenging. The RFC2822 standard suggests some guidelines for message-ID syntax, but it doesn't specify how message IDs should be generated.

If you're dealing with a message ID generated by Sendmail, be aware that the algorithm has undergone three changes, so it's essential to keep your analysis up-to-date and consider the Sendmail version used.

Finding and Using Message ID is a crucial step in email analysis, and I'm happy to guide you through it.

You can find the Message ID in Outlook 2010 by clicking on the Message Details icon, which looks like three dots. This will display additional information about the email.

In Outlook Web Access 2007 or later, you can find the Message ID by clicking on the three dots in the email message and selecting Message Details. This will show you the Message ID and other relevant information.

If you're using Gmail, you can find the Message ID by opening the email, clicking on the three vertical dots, and selecting Show original. This will open a new tab or window showing the original format of the email, including all headers.

You can also use the rfc822msgid operator in Gmail to search for an email by its Message ID. Simply input the Message ID into the search bar, preceded by the operator, and you'll get the exact email in the search results.

Here are some key takeaways to keep in mind when working with Message IDs: