Email authenticity analysis for litigation
Is this email genuine? We examine headers, DKIM signatures, server records and metadata to establish whether a disputed message was sent as it appears, altered after the fact, or fabricated.
Reviewed by the ITRS security team · Last updated
When authenticity is disputed
Email authenticity becomes an issue when one party produces a message the other says they never sent or received, or when a message's content, date or recipients appear to have been changed. Typical matters include contract disputes over what was agreed, employment cases built on a key email, fraud claims involving altered payment instructions, and family or estate disputes where a printout is the only copy offered.
Under the Canada Evidence Act (section 31.1) and Ontario's Evidence Act (section 34.1), the party seeking to admit an electronic record bears the burden of proving it is what it claims to be. A forensic examination provides evidence on that question, in either direction.
What headers and DKIM can prove
Every email carries a header block recording its journey: the servers that handled it, timestamps added at each hop, message identifiers, and the results of authentication checks performed by the receiving server. Headers are text and can be edited in a copy, which is why we look for internal consistency and for evidence that cannot easily be forged.
DKIM (DomainKeys Identified Mail, defined in RFC 6376) is the strongest of these. The sending domain's server signs selected headers and a hash of the message body with a private key; anyone can check the signature against the public key published in that domain's DNS. If a validly signed message's body or signed headers are altered, the signature no longer verifies. A signature that still verifies is strong evidence that those parts are as sent by a server holding the domain's key.
| Element | What it can show | Limits |
|---|---|---|
Received headers | Route and timing through mail servers | Can be edited in a copy; must be checked for consistency |
DKIM signature | Signed headers and body unchanged since sending by the signing domain | Only covers signed parts; old keys may have been rotated out of DNS |
SPF and DMARC results | Whether the receiving server judged the sender authorized (DMARC is defined in RFC 7489) | Recorded by the receiver at the time; shows authorization, not authorship |
Message-ID and thread headers | Consistency with the sending system and the conversation | Indicative rather than conclusive |
Server-side evidence
The strongest evidence often sits outside the disputed copy. If the email passed through Microsoft 365 or Google Workspace, the provider's records can confirm or contradict it: the sender's Sent Items, the recipient's mailbox, message trace records, mailbox audit logs and eDiscovery searches. A message that appears in a printout but has no trace in either party's mailbox or the server logs calls for an explanation.
Retention limits apply. Message trace and audit records are kept for limited periods, so where a dispute is anticipated, counsel should arrange preservation early.
Common fabrication signs
- Headers that are missing, truncated, or inconsistent with the provider the sender actually uses
- Timestamps that conflict across headers, or with the time zone of the sending system
- A DKIM signature that fails while other messages from the same sender, same period, pass
- A message present only as a PDF, printout or screenshot, with no native copy available
- A Message-ID format that does not match other messages from the same system
- Formatting, fonts or signature blocks that differ from the sender's genuine messages of the same period
- No corresponding record in either mailbox or the provider's logs
Reporting findings
Reports explain, in plain terms, what was examined, what each test showed, and what conclusions the evidence supports, including alternative explanations considered. Conclusions are graded honestly: a message may be consistent with authentic transmission, inconsistent with it, or the evidence may be insufficient to say.
Where the report is for use in court, it is prepared to meet the applicable rules for expert evidence, including in Ontario the contents required by rule 53.03 and a signed acknowledgment of expert's duty.
Collecting the original properly
The quality of the analysis depends on what is collected. Forwarding a disputed email to your lawyer, or printing it to PDF, discards most of the evidence.
Leave it in place
Do not forward, move or delete the message. Note which mailbox and folder it is in.
Preserve the mailbox
Place the mailbox on hold, or ask the provider or IT team to do so, so related messages and logs are not lost.
Collect natively
Export the message in its original format (for example .eml or .msg, or via eDiscovery export) with full headers, and record a hash value at collection, consistent with ISO/IEC 27037.
Ask for the other side's copy
Counsel can request the native message from the opposing party, which allows comparison of the two copies.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyEmail Authentication for a Vaughan Smart-Home IntegratorHow IT Rapid Support audited a Vaughan smart-home integrator's email authentication and implemented DKIM and DMARC to shut down domain spoofing.
Related.
- PracticeLegal TechnologyeDiscovery and forensic collection for counsel, expert-ready reports and legal-tech advisory for firms.
- ServiceDocument and metadata authenticity analysisWhen a Word document, PDF or image may have been backdated or altered, metadata, version history and system artifacts can often show when and how it was really created.
- ServiceDigital forensics expert witnessIndependent analysis of electronic evidence, written up as an expert report that meets the court's requirements and explained clearly under cross-examination.
- ArticleIs Your Company Email Easy to Spoof? SPF, DKIM & DMARC ExplainedMost small businesses have never checked whether criminals can send email as their domain. A plain-English guide to SPF, DKIM, and DMARC, and how to close the gap.
Acting on a matter that turns on electronic evidence?
Tell us who you act for and what is at issue. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.