Email Decoded — Read Between the Headers

Open any email's raw source and you'll see a wall of headers most people never look at twice: Received: chains, DKIM-Signature:, Authentication-Results:, and X- fields nobody explained to you. That wall of text is a complete, timestamped record of exactly how the message traveled, who touched it, and whether it's telling the truth about who sent it. This 616-page reference teaches you to read it - line by line, header by header - until a raw source view stops looking like noise and starts looking like a story.
Across 15 chapters, it covers the complete lifecycle of email infrastructure: the history of email standards from ARPANET to DMARCbis, how a message actually travels from sender to inbox, the difference between envelope and header addresses, MIME structure and encoding, and the complete authentication stack - SPF, DKIM, DMARC, ARC, and BIMI, including how they fail and how attackers work around misconfigurations.
It goes further than most references: a full chapter on email forensics walks through real investigative case studies, including a business email compromise, a compromised account attack where every authentication check legitimately passes, and an internationalized domain name homograph attack. Separate chapters cover spam scoring, inbound mail gateway architecture, encryption (TLS, S/MIME, PGP, MTA-STS, and DANE), and the complete SMTP response code reference.
Every technical claim is checked against the primary RFC text rather than paraphrased secondhand, and the material is current through 2026, including the DMARCbis standard. Written for systems administrators, security engineers, incident responders, and developers who need the real answer when a message fails to authenticate, lands in spam, or turns out to be part of an attack - not a forum thread from a decade ago.
Includes a quick-reference appendix, glossary, and index.