Getting Headers

Email headers contain all sorts of information about an email message. They're basically short log files containing information left by any computer that processed the messages.

This starts with the computer that initially sent the message. There are really two interesting pieces of data here. The first is the internet address of the sending computer. The other is what software that user used to send the message.

The sending IP address can help indicate if the message came from a "spammy" part of the internet. There are dozens if not hundreds of online databases that can be consulted to help spam email programs determine this.

It should be noted that headers can easily be forged. Any sending computer can easily fabricate data about non-existent previous transactions. This includes including false information about the program used to send the email.

Still, the information about the program used to send the email can be extremely valuable in help determining if it's spam or not. There are two reasons for this.

First, many spam sending programs provide spammers a list of possible programs to "spoof" as the sending application. There are a handful of popular spam-apps that default to certain values. Most spammers are too lazy to change them. A message sent claiming to be one of these suspect apps isn't certainly spam, but that data can be used in the filtering process.

The second reason is partially speculative - but there's a lot of circumstantial information that suggests that a portion of spam is sent from "zombie" systems using actual email clients triggered via an automated process. The reason these systems are compromised in the first place is that they failed to update their email clients to versions which don't have certain exploits. There's a specific version of Outlook Express which seems to be responsible for a staggering percentage of all spam on the internet as of recent.

Back