Foundations
Email Basics, Without the Jargon
If you have ever wondered what a raw email file is, why an email has headers, what an IP address is, or how a message gets from one computer to another, this page is the grounding layer.
.eml Files and Headers
A .eml file is a saved email message. Think of it as the original message in a portable text format. It usually contains the headers, the body, and often the MIME structure that describes attachments and HTML content.
Headers are the metadata lines at the top of a message. They tell you who the message says it is from, what systems touched it, when it moved, what authentication checks ran, and sometimes what marketing or security platforms were involved.
How Email Normally Moves
A normal message usually starts in a mail app, website, CRM, or bulk-mail platform. That system hands the message to a sending mail server, which passes it toward the recipient side. The recipient side may run spam filtering, security checks, or internal mailbox routing before the message finally lands in the inbox.
| Step | What It Means |
|---|---|
| Origin service | The system that created or first handed off the message. |
| External transfer | The public handoff from the sender side toward the receiver side. |
| Recipient gateway | The first inbound security or mail filtering layer on the receiving side. |
| Internal relays | Mailbox-provider or organization-internal systems that move the message after it is already inside the recipient environment. |
What an IP Address Is
An IP address is the network address a system uses to communicate on the internet or on a private network. A sender IP in email analysis usually tells you which external system actually handed the message toward the receiver.
Why EmailIntel Shows Public and Internal IPs
Public IPs are reachable on the internet and often matter most when you want to know where the message really came from. Internal IPs are usually private network addresses used inside the sender or recipient environment.
What a Domain Is
A domain is the readable name people use instead of raw IP addresses, such as example.com. Domains can have subdomains like mail.example.com or login.example.com.
In phishing analysis, the important question is usually not just whether a domain exists. The important question is whether it belongs where the email claims it belongs.
What a URL Is
A URL is the full address of a web resource, such as https://portal.example.com/login. URLs include a protocol, a host, and often a path and query string.
Attackers abuse URLs by using redirects, tracking links, raw IP hosts, lookalike domains, and fake login pages hosted on otherwise legitimate platforms.
What a Hash Is
A hash is a fingerprint of data. EmailIntel shows message hashes because they let investigators compare, search, and track a message or attachment without manually matching the full raw content every time.
If two files have the same strong hash, they are usually the exact same file. If they have different hashes, something changed.