About E-mail Envelopes

So you think e-mails don't come in envelopes?  Not so.  Here's a brief overview of how e-mail works, where the envelopes come into play, and why you shouldn't trust everything you receive in your "inbox".

(Technical note: by e-mail I mean SMTP and RFC-822 messages.  There are other types of e-mail — for example, Microsoft Exchange, Lotus Mail and so on — but SMTP / RFC-822 is the lingua franca of e-mail systems, so it seems fair to concentrate on that.)

"Traditional" Mail vs E-mail

A step-by-step guide to how messages are sent and received

Traditional Mail E-mail
Writing the Letter
When writing a letter, you'll usually start with your name and address … Your e-mail program knows your e-mail address, and puts that into the "From" header.
… then add today's date … Your e-mail program puts today's date in the "Date" header.
… and their name and address. You type the recipient's e-mail address into the "To" field (or you pick it from a list).
Sometimes there will be a "subject" line (especially for business letters) You type in a "Subject" line (most e-mail programs will insist that you always have a subject line)
Then there's the message itself, whatever you want to say. You type in the "body" of the message.
The Envelope
You get an envelope, and write the recipient's address on the front of the envelope.  Sometimes, you'll put your own address on the back (marked as "Sender").  You put the letter into the envelope, seal the envelope, and put the envelope into a mailbox. Your e-mail program connects to your outgoing mail server, and tells it your e-mail address (the "Sender"), and the address(es) of the recipient(s).  This is called the envelope.  Then it sends the message, which includes the "To", "From", "Date" and "Subject" lines, and the body of the message itself.
Receiving a Letter
The envelope containing the letter is delivered to the recipient (posted through their letter box).  The recipient can now look at both the envelope and the letter inside. The envelope and the message arrive at the recipient's mail server.  Usually what happens at this point is that the envelope is thrown away, and the message is placed into the recipient's mailbox (and will probably be downloaded into their "Inbox" whenever they next check for new mail).  Thus the recipient only gets the message, and never gets to see the envelope.

Conclusions

There is such a thing as an e-mail envelope — it's added automatically by your e-mail program when you press "Send", and it's removed automatically by the recipient's mail server just before the letter (without the envelope) is placed into their mailbox.

Why does it matter that the envelope exists, if we never see it?  It matters because its existence explains why the "To" and "Cc" lines of e-mails shouldn't be trusted.  People often receive "spam" e-mail, and can't understand why the message got sent to them, even though they're not listed in the "To" or "Cc" lines.  Sometimes the addresses in those lines are obviously "masked" addresses — e.g. 'undisclosed.recipients@example.com' — and sometimes they apparently list someone else's address.  In fact, the same thing happens when someone sends an e-mail and puts you in the "Bcc" line — again, you end up receiving the message, but you're not listed in the recipients.  Why is this?

The answer lies in the envelope.  Your address was on the envelope, and that's why the message ended up in your mailbox.  Unfortunately, the mail server threw away the envelope before it gave you the message, so you couldn't see that.

Trust

As for the issue of what you can and can't trust, again this is where traditional mail and e-mail are very similar.  Using traditional mail, there's nothing to stop you writing a letter and filling the whole letter with nonsense — e.g. putting the wrong address (or something that's not even an address at all) in the space where your address normally goes, and so on.  You could then seal that letter into an envelope, write someone's address on the front, write someone else's address on the back (as the "Sender"), and post the letter.

So it is in e-mail; it's perfectly possible (but illegal in some parts of the world) to create a bogus e-mail containing false information in the headers ("From" / "To" / "Cc" / "Subject" / "Date" etc) and any old rubbish in the body.  It's then equally possible (but not always legal) to wrap that message in an e-mail envelope with a false "sender" address.

(Note that in both traditional mail and e-mail you could use a "fake" recipient address on the envelope, but that would be pointless, because the envelope recipient address is the thing — in fact usually the only thing — that causes the message to be delivered.)

(Another side note: Why is it then that forgery in e-mail is so common, but in traditional mail is less so?  Answer: At least in part this is because with traditional mail, the cost of delivery is borne by the sender, with the recipient paying nothing; whereas with e-mail it's the other way round.)

So as far as trust goes, the short answer is: trust nothing.  ALL parts of an e-mail (just like traditional mail) can be faked.  This is just one of the reasons why you should never reply to "spam" mail — because the "From" address is almost always forged.

References

RFC 821 - "Simple Mail Transfer Protocol"

RFC 822 - "Standard for the format of ARPA Internet text messages"