How can I determine if an email was actually sent to me?
Someone claims to have sent you an email message. You never got it, as far as you know. How can you determine if the sender actually sent the message? How to you prove or disprove the claim?
This question is submitted by a reader via “Ask Erik” — a channel by which anyone can ask LuxSci a technical question.
Proving that an email was actually sent
As the purported recipient of an email message, the absolute best and simplest way to prove that a message was sent to you is to actually have a copy of that message. I.e., this could be:
- A copy in your INBOX or other email folder
- A copy in your permanent Email Archives
If you actually have a copy of the message, you are usually not trying to determine if the sender actually sent it. If you are, then your need to do a forensic analysis of the email headers (in particular the Received lines, DKIM signatures, etc) and possibly get your and the sender’s email provider involved to corroborate the evidence that you would find in there. How this would be done is beyond the scope of this particular article. Instead, we focus on the more common case — you, the recipient, do not have the message that the sender claims that s/he sent to you. What do you do?
What are the possibilities?
In reality, there are only a few things that could have happened:
- The recipient never actually sent the message
- The recipient did send the message, but it never actually made it to you
- The message did make it to you, but maybe it got accidentally or inadvertently deleted (or overlooked)
We discuss many of these possibilities in the article: The case of the missing or disappearing email messages. Here, lets work backwards with what you may be able to check and investigate. Start your search soon. The more time that elapses, the less evidence you may have as logs and backups get pruned over time.
Maybe it got accidentally or inadvertently deleted or overlooked?
First off, you should know that the sender could have put tracking on the message so that s/he was informed if you opened or read the message (even if you are unaware of the tracking). In such cases, the sender can disprove false claims of “I didn’t get it!” See Has your email been seen? Read Receipts and Web Bugs.
If you really never saw the message, start by searching all of your email folders for it. Maybe it was accidentally moved to a wrong folder or sent to your “Trash” folder. If you have a folder that keeps copies of all inbound email (like LuxSci’s “BACKUP” folder) … check there too. Absolutely check your Spam folder and/or Spam-filtering system. Your Spam-filtering system may also have logs that you can search for evidence of this message passing through it. Finally, check any custom email filters you may have setup with your email service provider or in your email programs. If you have filters that auto-delete or auto-reject some messages, see if it is possible that the message in question could have run afoul of one of these.
The searches above are pretty straight forward and you can do many of them yourself. Often, they will yield evidence of the missing message or turn up reasons who you might not have received it.
Maybe it was sent, but didn’t make it to you?
Email messages leave a trail as the travel from the sender to the recipient. This trail is visible in the “Received” email headers of the message (if you have it) as well as in the server logs at the sender’s email provider and your email provider. If you know some aspects of the message in question (i.e. the subject, sender, recipient, and date/time sent), you can ask your email service provider to search their logs to see if there is any evidence of such a message arriving to their systems. This will tell you if such a message ever made it to your email provider; however, email providers typically can only search the most recent 1-2 weeks of logs with ease. So, if the message in question was from a while ago, your email server provider may not be able to help you (or may need to charge you a lot of money to manually extract and search archived log files, if they have them).
If your email provider does not have any record of the message or can not search their logs, then you (or the sender) can ask the same question of the sender’s email provider. If they can provide records of such an email being sent through their system, that will also answer your question.
The log file analysis provided by the email providers could also shed light on why you didn’t get the message. I.e., your email address might have been spelled wrong, there could have been a server glitch or issue, etc., etc. However, if the message was sent long ago, the chances of learning anything useful from the email providers is small. Also, if you use a commodity email provider such as AOL, yahoo, Outlook, Gmail, etc., you may find it difficult or impossible to contact a technical support person and have them perform an accurate and useful log search for you. More premium providers, like LuxSci.com, do this kind of thing as a matter of course.
The last thing you can do is have the sender look in his/her sent email folders for a copy of that message. If s/he has it, then that can indicate that s/he sent it and can be also used to perhaps see why you didn’t get it (i.e., wrong email address, content that would have triggered your filters, etc). However, be wary. It can be easy to forge a message in a sent email folder, so I would not recommend using that, by itself, as court-worthy evidence that the message was indeed actually sent. And, even so, it does not prove that it ever made it to your email provider or your Inbox.
The recipient never actually sent the message
If the message was never actually sent, but the sender claims that it was, you are in a bind. If this purported sending event was recent, then the data from your email service provider can definitively prove that it never made it to you…. but that doesn’t prove that it was not sent. The sender may claim that they do not have a record of sent messages and that their email provider will not do log searching, and that may also be true. At this point, you are stuck without a resolution.
While email is a reliable delivery system, there are many ways for messages to not make it to the intended recipient these days. Whether it was not sent, or was sent and never arrived, the result is the same … no message for you. I would ask your lawyer, but I would suspect that just sending an email message, without any definitive confirmation that it was received, would not be a legally binding form of notice. However, that may also depend on the details of any contracts between you and the sender.