HackBlue

Tools · Email security · 21 / 26

The Message-ID is not the mailbox item id

Message-ID is a header string, usually chosen by the sending software. The mailbox item id is the provider’s identifier for the stored copy. Write both. The domain inside Message-ID is not the From address.

9 min read · practice only with authorization

The stored copy has its own id

The mail platform assigns an item id to the copy in a mailbox. A search, a purge, or a case note that means that stored copy needs the item id. The Message-ID can appear on more than one stored copy, for example after a user forwards the same bytes. Matching Message-ID values are a lead. They are not one mailbox item.

If you only have the header, write “mailbox item id not opened.”

What to write down

File Message-ID, the mailbox item id, and the From address, each labeled. Do not use the domain in Message-ID as the sender. Do not claim a platform search is complete when you searched only one of the two ids.

Lab: one header id and one stored copy

A lab message has Message-ID <lab-8841@mail-out.example> and From notices@lab-mail.example. The mailbox API shows item id AAMk-441 for that copy. A draft says the sender domain is mail-out.example because that is the domain in Message-ID, and uses lab-8841 as the only id in the case file.

The note quotes both ids and the From address. mail-out.example is the Message-ID domain, not the From mailbox. AAMk-441 is the stored copy. A later search for other copies can use the Message-ID as a lead and still record each item id it finds.

Snippet
Message-ID: <lab-8841@mail-out.example>
mailbox item id: AAMk-441
From address: notices@lab-mail.example
write: two ids, plus the From address
not: sender domain mail-out.example

Diagram

Keep the header id and the stored copy apart

  1. Message-ID

    The string in the header.

    Header
    <lab-8841@mail-out.example>
  2. From

    The mailbox address, from the From line.

    Header
    notices@lab-mail.example
  3. Item id

    The provider id for this stored copy.

    Mailbox
    AAMk-441
  4. A second copy

    May repeat the Message-ID and still have its own item id.

    Note
    record each item

Check yourself

1. Message-ID ends in @mail-out.example and From is notices@lab-mail.example. What is the sender mailbox?

2. Two mailbox items share one Message-ID. What do you have?

3. You have Message-ID and have not opened the mailbox item. What do you write?