[ Headers & delivery errors ]
Message-ID domains: why they do not prove sender ownership
A Message-ID is a correlation identifier, not evidence that its domain owner sent or approved the message.
By the EmailAuth research team · 3 min read
[ Key points ]
- Do not confuse familiarity with ownership
- Correlate more than one field
- Account for replay and collisions
[ Takeaway ]
A Message-ID is a correlation identifier, not evidence that its domain owner sent or approved the message.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Correlate more than one field
Message and queue identifiers serve different purposes.
Next steps
- Search exact values with authorization.
- Compare recipients and times.
- Preserve per-hop queue context.
CISO / SecOps
Account for replay and collisions
An untrusted identifier should not be a sole security key.
Next steps
- Review deduplication assumptions.
- Distinguish signed content from signer identity.
- Retain evidence of thread manipulation.
Founder / Non-technical
Do not confuse familiarity with ownership
A recognizable identifier can be only sender-supplied text.
Next steps
- Use identifiers for correlation.
- Verify consequential instructions separately.
- Ask for trusted authentication evidence.
[ FAQs ]
Frequently asked questions
Does the Message-ID domain prove domain control?
No. Its syntax and presence do not authenticate the creator’s ownership.
What is Message-ID intended to identify?
A particular version of a particular message with a globally unique identifier.
Is Message-ID the same as a queue ID?
No. Queue identifiers belong to particular transport systems and events.
Can a copied identifier help imitate a thread?
Yes. References are useful context but can be sender-controlled or copied.
Should I deduplicate critical actions only by Message-ID?
Not without an application-specific design that accounts for untrusted values, collisions and replay.
Does a DKIM signature make the Message-ID domain the signer?
No. The actual DKIM signing domain remains a separate identity, even when Message-ID is signed.
Did the fixture verify ownership of familiar.example?
No. It extracted a synthetic identifier without network or authentication checks.
Is Message-ID used for DMARC alignment?
No. Use the relevant SPF or DKIM authenticated identifiers and visible author domain.
RFC 9989 Domain-based Message Authentication, Reporting, and Conformance
[ Sources ]
Sources
- RFC 5322 Internet Message Format
Sections §3.6.2 · §3.6.4 · §3.6.7
- RFC 8601 Authentication-Results
Sections §1.2 · §2.2 · §2.7 · §4.1 · §5 · §7
- RFC 9989 Domain-based Message Authentication, Reporting, and Conformance
Sections §4.2 · §4.3 · §4.4
[ Glossary ]
Glossary
- Message-ID
- A message-format identifier intended to uniquely identify a particular message version.
- References field
- A message field carrying identifiers that relate it to earlier messages.
- Queue ID
- An identifier assigned by a mail system to track a particular queued delivery event.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption