Does order in email headers indicate which MTA inserted each? - smtp

Question

I'm trying to analyze a mail header to figure which element (MUA, MTA...) creates each. My supposition is:
The sender MUA composes the body (including Content-Type, Mime, Content-Transfer-Encoding), and sends it via SMTP to the sender border MTA. MUA provides info for the the initial headers (From, To, Reply-To, ) which are inserted by this MTA
This MTA inserts MessageID and Return_Path (and all extra headers and X-Headers it desires)
Then it starts 'hoping'. On each hop the receiving MTA inserts 'Received:' header and each other header it considers
If order is kept and each MTA inserts its headers AT THE TOP of the message, it should be easy to figure which MTA has inserted each header... but I can't find a valid scheme
Fields as DKIM-Signature, Authentication-Results, Received-SPF... appear in different places. Which MTA creates each? Who DKIM-signs the email (I suppose it must be the sender border MTA) Who authenticates SPF-DKIM-DMARC?
A lot of X-Headers are added, many related to spam control, and I cant find which MTA (on with hop) created each
Could you help me, please?

Answer 1

The MUA (Mail User Agent, RFC term for mail client) will add most headers that you can see in email clients, in particular From: and To:. (You can sometimes see this in the To: header when someone has "funny" nicknames for someone in their address book. Or when "From:" and SMTP envelope from (as in the MAIL FROM: command) disagree, even though may servers will reject such messages, as it's often a spam indicator.) The MUA will set the Reply-To: header as well, especially if the MUA is really a customer management system. The MTA (Mail Transfer Agent, actual SMTP server) may include bounce information (VERP).
The MUA then submits the message to the MTA. Every program (mail server, firewall, etc) that touches the email can add headers. For example, the MTA would normally do the DKIM signing (and add the relevant headers). It must prepend Received: header (i.e., put it at the top) and it must not mess with other Received: headers. Still some programs like firewalls may mess with headers.
You can see multiple DKIM signatures (see DKIM selectors), for example, when an email gets resent in the context of a mailing list. You could see a DKIM signature from the original sender to the list, then more headers including an additional DKIM header when the mailing list server sends its to the final recipients.
As for X-... headers: these are non-standard headers (hence the X- prefix). Everything is off here. Some sending MTAs insert them for tracking purposes (e.g., to catch spammers among their customer), some mail receivers put their spam assessments in a special x-header. Even the MUA may put some x-headers in the emails, for example, Claws Mail puts in a header for the account the mail came from, when it downloaded it, and so on. You may or may not trust these, and in fact, MUAs may have settings to indicate which x-headers they should trust.
To that regards, even the Authentication results header and such can come form anywhere along the road. Even the initial sender could add one, like some anti virus programs do, to indicate that they scanned the outgoing mail. Again, it's up to the receiver to decide whether to trust these headers. Clearly you want the mail server closest to you to do DKIM checks and anything related to authentication, as you can hopefully trust that server's verdict.
So, does order indicate which mailer inserted a header? Yes, but... mail servers may or may not conform to all parts of the RFCs, and many mail servers follow Postel's law and be somewhat lenient in what they accept.