Email Decoded — Read Between the Headers
Email Decoded — Read Between the HeadersA 600+ page professional reference on email infrastructure, authentication, and forensics — from the person who has spent 25 years keeping enterprise mail flowing.Every email you've ever sent left a paper trail. Can you read it?Open any email's raw source and you'll see a wall of headers most people never look at twice: Received: chains, DKIM-Signature:, Authentication-Results:, X- fields nobody explained to you. That wall of text is a complete, timestamped record of exactly how the message traveled, who touched it, and whether it's telling the truth about who sent it.This book teaches you to read it — line by line, header by header — until a raw source view stops looking like noise and starts looking like a story.Whether you're a systems administrator debugging why legitimate mail is landing in spam, a security engineer investigating a business email compromise, a developer integrating an ESP, or just someone who wants to understand what actually happens between clicking "Send" and a message appearing in an inbox eight time zones away — this is the reference built for that moment when you need the real answer, not a forum thread from 2014.What's Inside15 chapters. 8 original diagrams. Every RFC citation fact-checked against the primary source.Chapter 1 — The History of Email. From ARPANET's accidental "lo" in 1969 to DMARCbis becoming an official standard in 2026. Not trivia — the why behind every header you'll encounter later.Chapter 2 — How Email Travels. The complete journey from MUA to MSA to MTA to inbox, with every hop, every port, and the TLS handshake that (usually) protects it along the way.Chapter 3 — Envelope vs. Header Addresses. The single most misunderstood concept in email — why the address in your From: line and the address your mail server actually talks to are frequently two different things, and why that matters for DMARC.Chapter 4 — Message Structure. Headers, body, the one blank line that separates them, and the structural errors that break parsers in production.Chapter 5 — All Standard Headers. The complete reference — every header defined in RFC 5322 and beyond, organized by function, with the RFC section number for every claim.Chapter 6 — Email Authentication. SPF, DKIM, DMARC, ARC, and BIMI — not just what they do, but how they fail, how attackers work around misconfigurations, and how DMARCbis changes the rules in 2026.Chapter 7 — Content-Type in Detail. How email knows what it's carrying, and how attackers exploit the gap between what a Content-Type header claims and what a client actually renders.Chapter 8 — MIME in Detail. Base64, quoted-printable, boundaries, and the parsing internals that determine whether a malformed message gets rejected, mangled, or silently exploited.Chapter 9 — X-Headers and ESP Headers. The non-standard extensions every major provider adds — and what they leak about your infrastructure if you don't strip them.Chapter 10 — Spam Scoring Headers. How filters actually make decisions, decoded provider by provider — Microsoft's Forefront report, Gmail's signals, and the header-level detail most guides skip.Chapter 11 — Reading and Troubleshooting Headers. Eight real diagnostic scenarios, from "why is this going to spam" to SMTP smuggling, worked start to finish.Chapter 12 — Email Forensics. Chain of custody, IP attribution, DKIM replay detection, and three full case studies — including a compromised-account attack where every authentication check legitimately passes.Chapter 13 — Email Encryption. TLS, S/MIME, PGP, MTA-STS, and DANE — what's protected, what isn't, and a practical playbook for the post-quantum transition already underway.Chapter 14 — Inbound Mail Gateways. The seven-module filtering pipeline every message passes through before it reaches your inbox, mapped to Proofpoint, Mimecast, Barracuda, Microsoft 365, Google Workspace — and a complete open-source Postfix/Amavisd/SpamAssassin/ClamAV build you can deploy yourself.Chapter 15 — SMTP Response Codes. The complete 4xx/5xx reference, decoded provider by provider, with a diagnostic methodology for the codes that appear in no table anywhere.Plus a Quick Reference appendix (header index, SPF mechanisms, DKIM/DMARC tag reference, SMTP codes, a troubleshooting decision flowchart) and a full Glossary and Index — built as a reference you keep open, not just a book you read once.Built DifferentlyEvery RFC citation is verified against the primary source — not paraphrased from a blog post that paraphrased another blog post. Where a claim depends on a specific RFC section, that section number is in the text.It's current through 2026 — including RFC 9989/9990/9991 (DMARCbis, published May 2026), the Google/Yahoo/Microsoft bulk-sender enforcement timeline, and the post-quantum cryptography transition already reaching OpenPGP and TLS.It doesn't stop at theory. Every mechanism is paired with a real header example, a real Postfix config block, or a worked diagnostic case — the kind of detail you'd otherwise only get from twenty-five years of actually running mail infrastructure.It's honest about what changes. Provider-specific behavior, default configurations, and draft specifications shift without notice. The book tells you which details to re-verify against current documentation before you rely on them in production — and points you to exactly where to check.Free Companion Resources — emaildecoded.wiki Every copy includes access to the book's companion website: Chapter Companions (Chapters 2–15) — worked examples, deep-dive articles, and hands-on labs that extend each chapter Implementation Guides — step-by-step SPF, DKIM, and DMARC deployment walkthroughs Learning Path — a structured route through the material if you're starting from zero RFC Tracker — a live-updated feed of relevant RFC status changes, so the book's authentication chapter never goes stale DMARCbis Migration Checklist and Header Analysis Tools directory Who Wrote ThisIovo is a pen name. The author is an IT professional with over 25 years of hands-on experience in email infrastructure, specializing in email security and authentication. Across that career: designing, implementing, and supporting enterprise email security and SMTP boundary systems, working with both commercial gateways and open-source mail platforms, with a deep focus on SPF, DKIM, and DMARC in production. The author holds a Master's degree in Mathematics and Computer Science and multiple industry certifications in email security, Linux, and networking.The pen name is intentional. The experience behind it is not.This book was written with the assistance of AI tools. All content has been reviewed, fact-checked, and edited by the author, who is responsible for the final text.What You Get The complete PDF — 616 pages, 8 original diagrams, fully indexed Full access to the emaildecoded.wiki companion site (Chapter Companions, Implementation Guides, Learning Path, RFC Tracker) Free updates as the companion site's RFC Tracker and migration checklists evolve Every email leaves evidence. Learn how to read it.
Get it → iovobooks.gumroad.com