Forwarded email detection

Question

Is there any way to detect (using RFC 2822 headers) that an email is a forwarded email?

Answer 1

There are two things that are normally referred to as "forwarding".

When you set up automatic account-level forwarding to another email address, your mail system will usually introduce an extra header to enable it to detect and break mail loops. Unfortunately, the name of this header has never been standardized. Some use Delivered-To, some use X-Loop, some use X-Original-To, some use an X-header proprietary to their mail software. But there's no single header field that's present all cases.

When you manually forward a message by clicking the "Forward" button in your mailer and entering a recipient email address and some descriptive text, a new message with a new Message-ID header is generated. The set of headers on this message will be indistinguishable from a normal reply -- In-Reply-To and References are set in exactly the same way. The only difference is that the Subject header will usually start with "Fwd:" or end with "(fwd)". ("Usually" because some clients format it as "[Fwd: <original subject>]" with square brackets around the new subject, some clients localize the prefix Fwd: into their own language, and some users manually edit the Subject before hitting "send".)

So there are good hints that a message is forwarded, but no hard and fast rules.

Answer 2

Reading the spec, CTRL+F for "forward" gives the following header fields:

resent-date     =       "Resent-Date:" date-time CRLF  
resent-from     =       "Resent-From:" mailbox-list CRLF  
resent-sender   =       "Resent-Sender:" mailbox CRLF  
resent-to       =       "Resent-To:" address-list CRLF  
resent-cc       =       "Resent-Cc:" address-list CRLF  
resent-bcc      =       "Resent-Bcc:" (address-list / [CFWS]) CRLF
resent-msg-id   =       "Resent-Message-ID:" msg-id CRLF

I'm not sure whether the major mail software uses these though.

EDIT

Read the spec a little too quickly, there is also this note:

Note: Reintroducing a message into the transport system and using resent fields is a different operation from "forwarding". "Forwarding" has two meanings: One sense of forwarding is that a mail reading program can be told by a user to forward a copy of a message to another person, making the forwarded message the body of the new message. A forwarded message in this sense does not appear to have come from the original sender, but is an entirely new message from the forwarder of the message. On the other hand, forwarding is also used to mean when a mail transport program gets a message and forwards it on to a different destination for final delivery. Resent header fields are not intended for use with either type of forwarding.

There are no other notices of "forwarding", so there are no header fields that you can use to detect the forward, except for the subject = "Fwd: <msg>" convention.