What actually happened to this message?

This message passed through 10 recorded hops. Received headers are added to the TOP as a message travels, so the list below runs newest first: the first entry is the last server to handle it, and the final entry is the earliest recorded. Some hops record less than others — 2 without a "from" clause, 3 without a "for", 3 without an id, which is ordinary rather than a defect. Only "by" is written by essentially every server; the rest are optional and plenty of mail systems omit them.

1. 1by mx-eu-03.ponee.iofrom mxout2-ec2-se.apache.orgwith ESMTPS22:50:08Z+19s
2. 2by mxout2-ec2-se.apache.orgfrom mail.apache.orgwith ESMTPS22:49:49Z+2s
3. 3by not recordedfrom not recorded22:49:47Z?+0s
4. 4by not recordedfrom not recorded22:49:47Z?+0s
5. 5by apache.orgfrom spamproc1-he-de.apache.orgwith ESMTP22:49:47Z+0s
6. 6by spamproc1-he-de.apache.orgfrom localhostwith ESMTP22:49:47Z+2s
7. 7by localhostfrom mx1-he-de.apache.orgwith ESMTP22:49:45Z+0s
8. 8by mx1-he-de.apache.orgfrom aurora.example-company.comwith ESMTPS22:49:45Z+7s
9. 9by aurora.example-company.comfrom aurora.example-company.comwith ESMTP22:49:38Z+0s
10. 10by aurora.example-company.comfrom smtpclient.applewith ESMTPSA22:49:38Z

The topmost hop was written by mx-eu-03.ponee.io, the last server to handle this message. Everything below it was written by servers earlier in the chain, and a forged message can contain any Received headers its author chose to invent — they cost nothing to fabricate. This tool cannot tell you where the real chain starts: across 120 real messages checked while building it, the topmost server never matched the one that recorded the authentication results, and none carried any marker identifying a boundary. So no hop here is marked as verified or genuine, because that is not something the headers can establish. You are the one who knows which of these hosts are yours — from the first host you recognise and upward, the record was written by infrastructure you control; below that, treat it as the sender's account of itself.

apache.org recorded auth=none when it received this message. This is that server's own report of what it concluded at the time, not something checked here — the message body was not pasted, signing keys rotate, and the sending domain's DNS may have changed since. Where two servers in a path disagree, that is usually not a contradiction: a mailing list that modifies a message breaks a signature that was valid when it arrived.

spamproc1-he-de.apache.org recorded dkim=pass (header.d=example-company.com) when it received this message. This is that server's own report of what it concluded at the time, not something checked here — the message body was not pasted, signing keys rotate, and the sending domain's DNS may have changed since. Where two servers in a path disagree, that is usually not a contradiction: a mailing list that modifies a message breaks a signature that was valid when it arrived.

aurora.example-company.com recorded dmarc=pass (header.from=example-company.com) when it received this message. This is that server's own report of what it concluded at the time, not something checked here — the message body was not pasted, signing keys rotate, and the sending domain's DNS may have changed since. Where two servers in a path disagree, that is usually not a contradiction: a mailing list that modifies a message breaks a signature that was valid when it arrived.

aurora.example-company.com recorded spf=pass (smtp.mailfrom=example-company.com) when it received this message. This is that server's own report of what it concluded at the time, not something checked here — the message body was not pasted, signing keys rotate, and the sending domain's DNS may have changed since. Where two servers in a path disagree, that is usually not a contradiction: a mailing list that modifies a message breaks a signature that was valid when it arrived.

The earliest hop is stamped 22:49:38Z and the most recent 22:50:08Z, a difference of about 30 seconds. The largest single gap is roughly 19 seconds, between mxout2-ec2-se.apache.org and mx-eu-03.ponee.io. Treat all of these as estimates rather than measurements: every hop stamps its own clock, nothing keeps those clocks in step, and a difference of a few seconds may be drift rather than delay. 2 timestamps use "-0000", which RFC 5322 defines as an UNKNOWN time zone rather than UTC — those are read as UTC here for want of anything better, so any gap involving them is less certain still.

The From address and the Return-Path are both at httpd.apache.org. That is the relationship SPF and DMARC alignment turn on, and it is what a straightforward sender looks like. This is an observation about two headers, not a verdict — whether alignment actually passed is what the receiving server's own dmarc= result above says.

Subject: httpd-test: mod_test_session included, mod_session excluded, tests break The sender's own Date header reads Tue, 28 Jul 2026 23:49:37 +0100, which is set by the sending client and is not necessarily consistent with the Received timestamps above. The message carries a List-ID of <dev.httpd.apache.org>, so it passed through a mailing list — which is worth knowing, because lists routinely modify messages and break signatures that were valid when they arrived.

This message carries 1 DKIM signature, signed by example-company.com. More than one is normal: a sender signs, and a forwarder or list may add its own. Whether any of them actually verify is not something this tool can tell you — that needs the message body, which is not pasted here, and the signing key as it was published at the time. The receiving servers' dkim= results above are the record of what verification actually found.