Email metadata
- Email metadata
The structured information a message carries about itself — who sent it, when, by what route, and with what identifiers — as distinct from the body text a reader actually sees.
Two layers, and only one is visible
Header metadata on the face of the message is what appears when you open an email: sender, recipients, CC, date, subject. It is what gets printed on a produced exhibit and what populates most of the fields in a load file.
Transport metadata is the layer beneath. The Received chain records every
mail server the message passed through, in reverse order, with timestamps. The
Message-ID uniquely identifies the message. Authentication results record
whether the sending domain’s SPF and DKIM checks passed. None of this is
visible in a normal mail client, and none of it is printed on a rendered PDF.
Why the second layer matters
Because it is where questions about a message’s origin get answered. The visible
From header is trivially forgeable — it is a display field, set by the sender.
The Received chain and the authentication results are added by servers along
the way and are much harder to fabricate consistently.
If a party disputes that they sent a message, the argument is conducted in the
transport headers, not in the body. This is the practical reason to retain the
.eml originals even after producing PDFs: the PDF shows
what the message said, the .eml shows how it arrived.
Metadata and production
Production protocols specify metadata fields to be delivered alongside images: custodian, date sent, date received, from, to, cc, bcc, subject, attachment count, and the parent-child identifiers. All of it is extracted from the native files, which is why natives are retained through an imaged production.
Producing a document while stripping its metadata is a thing parties argue about, and the position is much easier to defend when nothing was stripped because the natives were kept intact throughout.
The thing people get wrong
Metadata is not a bonus attached to the document; for email it is substantially what the document is. A message body reading “Confirmed, go ahead” is meaningless without who sent it, to whom, and when. That is metadata, and it is why an exhibit that shows only the body — a screenshot, a copied-and-pasted quote — is so much weaker than one carrying the header block.