How to prove someone sent an email to you?

Question

There are similar question about how to prove YOU sent an email, but I want to know if it is possible to prove a 3rd party sent an email to me.

An individual sent some very threatening emails to my company, enough to warrant providing the email copies to authorities. Now, this individual is claiming he did not send the emails and they are fake. He even says in his final email that he will get away with it because emails are so easy to fake and so no one will believe he sent them.

I have the emails, the headers, etc but I do not know what I can provide that will show a specific mail server sent the emails or IP address or anything.

What steps do I need to take in order to prove this individual did send these emails?

Answer 1

It sounds like your message is signed using DKIM which is good, because this provides cryptographic proof that the sending mail server sent the message and verifies the integrity of several key fields such as the to and from addresses. Assuming that the sending mail server can be trusted to properly authenticate the sending user (eg. via their login) then this essentially proves that the user in question sent it.

I'd provide the whole header to authorities, but the section which looks like this will be most important:

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=mime-version:message-id:date:subject:from:to:cc:content-type;
bh=62R0FTDx1ty9lsn/QNK3rrnxESP0zwJj1ca95CbZzxQ=;
b=JAd1gFDtEKmA+KtSYuALKekaVb150ZFfqxluvTb6nc3pi5n2l8EE8BjZFTlyuif+h9
aGk6MyYrsBLFYjAQtweTcBlChVvBTw01mhJKGrKEVAKrnmHNknN9ivoV90/7024UEjGJ
w5VOtjmTC0lBCYIrnuqK13yDbjx2Ra4SzJ62RaUpoM4eECsJbBLK9BK0TULg92ozfwf9
UHF4ozrXIyTgeG87ifDtuz5ddrwFvP47mgoqP7ENaXsxhGFZqHOFJly7jrvNbWEWEfRX
ygY2Miuu/DnB1g1C/ahGq8VtQvb0XmVEK4XESJPBgP3F0wfpT4MrGbJbYiW3Z9SIiA1F
jhXw==

Your mail server might automatically validate the DKIM signature and include the validation result in a header such as "dkim=pass", but you don't have to trust this and you could verify the signature yourself if they questioned it.

Answer 2

The headers of the email will contain traces of the servers that were used and the originating account. But the authorities know this and will take care of it.

Besides the technical proof, it is also possible to compare wording and phrasing to provide a likelihood that an individual sent an email. Threatening emails tend to get creative and provide many unique characteristics. It's not proof, but it adds to the likelihood.

EDIT You can also run the header strings through a parser. That will tell you (and your audience) a lot.

Answer 3

What steps do I need to take in order to prove this individual did send these emails?

You can't with just the information you have on your MX. You can't both technically (information from the other MX aren't accessible to you) and legally (you aren't allowed to investigate or prosecute).

Provide evidence

This is the job for your authorities, who will be armed to conduct this investigation with success, if and only if, you provide them with:

• the original message in its original version, i.e. which is one uniq piece of raw text, containing a long list of headers and a long set of contents,
• the correct extract from your MX logs showing the exact events related to this exact message (identified by its uniq MSGID): reception and delivery.

Protect evidence

You have to keep these two pieces of evidence protected from any tampering (either internal or external). The best would be to keep them offline with their original date (any pass through anything like a text editor will corrupt them and render your action useless and abusive).

Answer 4

Unfortunately hiding behind plausible deniability is not necessarily an unrealistic plan on the part of the email sender.

As already discussed, DKIM signatures can verify the authenticity of an email and that it was indeed sent by the email provider from one address to another. The trouble is that this doesn't prove that a particular person sent the email - only that their account was used to send the email. If you can get the originating IP address out of the email provider (either in the headers or elsewhere) and trace that to a particular physical location (which can be hard after-the-fact if the home IP address has changed) then you could even establish that their account was used to send the email from their home, BUT...

Someone who thinks this through a bit more might still have plenty of options, especially keeping in mind that with criminal accusations the relevant level of proof is "Beyond a reasonable doubt". I.e. (said by the person who is being accused of sending the emails):

1. I had lots of trouble with viruses and malware on my computer around then. I bet my email got hacked (and yes, as a security professional I roll my eyes at that, but it doesn't mean it won't work)
2. My teenage (aka underage) son heard me complaining about [COMPANYNAME] and he admitted to me that he logged into my computer and sent some emails to them (probably plenty of people out there willing to throw their kids under the bus, especially since young kids might not see any repercussions at all).
3. I left my computer open at starbucks while I went to the bathroom and when I came back 5 minutes later someone was on my computer. They ran away when I yelled at them but I didn't see anything missing so I just forgot about it until now... (obviously won't work if you've tied the email sending to their house)

Granted, depending on the circumstances such stories might get someone laughed out of the room, but they might not. I can't make any claims about that, because everything I know about court rooms I learned from TV crime shows. However I think it is important to keep in mind that all you can really prove is that a given person's email account was used to send an email. You can't even necessarily prove that it happened from a given location - only that a computer at the given location was used to send the email. After all if someone remote connected to a computer in someone's home and used that to send an email, the email provider would still see the person's home as the "originating" endpoint, even though it isn't really.

Probably the best way of "proving" that a particular person sent the email is by looking at the specifics of the language (i.e. schroeder's answer).

Answer 5

EU legislation is quite clear about it. It says that email has not been sent until the recipient confirms (reply) on email. The interpretation of the legislation is quite reasonable, while until the email is in a system under sender control anything can happen. Therefore, you cannot prove that the email has been sent until recipient replies to this particular email.