Reverse Engineer Competitor Email Sends by Reading the Hidden Headers

Every marketing email you receive is a small confession about the sender's stack. The hidden metadata sitting above the body, the headers, leaks information the sender rarely thinks to scrub: the ESP platform, the sending IP, the signing domain, the bounce handler, sometimes even the campaign ID. Reading those lines carefully is the foundation of competitor intelligence for anyone running outreach at scale from Sydney, Melbourne, Brisbane or Perth.

Treating email header analysis as a strategic discipline rather than a debugging chore changes what your inbox becomes. Instead of swiping past rival sends, you start treating them as free research data. A single promotional message from a competing brand reveals authentication choices, delivery infrastructure, and timing choices. Assembled over weeks, those clues describe a rival's sending playbook in surprising detail.

In Australia that practice runs alongside a strict regulatory frame. The SPAM Act 2003, enforced by ACMA, sets consent and identification rules that shape how local brands send and how they tag their messages. Combined with the Australian Privacy Principles, the local stack pushes competitors toward particular ESPs and particular header patterns, which makes a deliberate read across the Received chain worthwhile rather than academic.

This piece walks through how to read authentication records, fingerprint the sending platform, time competitor cadence, infer their segmentation logic, account for Australian delivery realities, and build a workflow that turns headers into a repeatable research output.

Reading the authentication chain without misreading it

Every legitimate marketing send now carries three signatures: SPF, DKIM and DMARC. SPF lives in the Received chain as the sender field and the matching envelope-from. DKIM shows up as "DKIM-Signature:" with the signing domain (d=) and selector (s=). DMARC is visible in the Authentication-Results line as dmarc=pass or dmarc=fail.

What you are really looking for is alignment. If d= in DKIM matches the visible From domain, the sender has invested in brand-aligned signing. If not, you have just discovered they are sending from a sub-account, a third-party relay, or a pool they have not tightened down. For competitor mapping, alignment gaps are useful because they tell you whether their primary stream is run in-house or routed through an agency.

Australia's major receiving domains, including the big four banks, telcos such as Telstra and Optus, and retailers on .au ccTLDs, apply aggressive DMARC policies and reject mail that fails alignment at the header-from. A competitor whose DKIM aligns but whose SPF fails is, practically speaking, getting filtered to junk for half their list. That is competitive intel you cannot buy from any report.

Identifying the ESP and infrastructure fingerprints

Authentication answers what, not who. The next step is to identify the underlying email service provider and the surrounding infrastructure. Some indicators are blunt: a Return-Path pointing to bounce.mcsv.net is Mailchimp, while one routed through em-sj01.purelymail.com suggests a smaller Australian reseller. Message-ID domains, the bracketed string after "Message-ID:", also leak origin. A "cmail" prefix usually belongs to Campaign Monitor, and "m1.bne" suffixes are an old giveaway for the Brisbane data centre of a platform that has since moved.

Look past the obvious for second-order clues. Custom X-headers like X-Mailer, X-Campaign, X-Source, X-Track-Id, or List-Unsubscribe-Post values betray the platform even when a brand wraps their sending domain. ESPs also stamp unique feedback loop addresses and abuse handles, which you can confirm by mailing back to the abuse alias and seeing what hits a ticket queue.

Fingerprint	Likely platform	Key markers
Return-Path domain	ESP identity	bounce., return., mail.* subdomains
Message-ID pattern	Platform origin	cmail, mcd, sg, bne tokens
Custom X-headers	Workflow + tracking	X-Campaign-Id, X-Track-Id, X-Mailer
List-Unsubscribe structure	Standards compliance	RFC 8058 one-click POST or mailto
Feedback-loop address	Delivery programme	fbl@, cfr@, msoprd.net

A single message is a guess. Twenty messages from the same sender over a month lets you cross-check and lock the fingerprint. Sydney senders tend to route through Syd or BNE IX, Melbourne through MEL POPs, which is useful when you want to know whether your competitor is hitting Australian consumers from local infrastructure or from overseas relays.

Mapping send cadence and timing in local time

Headers carry two timestamps: the internal Date header, set by the sender's clock, and the arrival pattern visible from chained Received hops. Subtract the hop count and you can usually recover the moment a competitor pressed send.

Track that moment across weeks and you get a cadence curve. Most brands in Australia fall into one of four patterns: weekly brand digests on Tuesday morning AEST, fortnightly retail offers around payday, daily transactional-plus-promotional hybrids from fintechs, and broadcast-only promo blasts tied to events such as EOFY sales, Melbourne Cup, or the AFL and NRL finals. Each pattern tells you something about list maturity. Daily hybrid senders almost always have a strong engagement base, whereas mid-month blasts suggest a list-heavy, less-active approach.

Cadence signals worth tracking

• The gap between two consecutive sends to the same address tells you whether the brand groups campaigns weekly or weekly-by-segment.
• A sudden surge in mail frequency before Australia Day, ANZAC Day campaigns or Black Friday is a reliable predictor of how actively they monetise the holiday calendar.
• A flat or thinning cadence in May or June often signals list-hygiene work and a smaller active cohort that the brand does not want to broadcast.
• Time-of-send clusters around 7am AEST or 10am AEDT indicate a send window aligned to Australian open rates rather than the ESP's UTC defaults.

Once cadence is mapped, cross-reference it with promotions. If the brand always mails on Thursday but pushes harder before quarterly retail peaks, their send strategy is really a calendar pinned to Australian shopping windows. That is useful intel for planning competing pushes from your own warm-up cycle.

Inferring segmentation and list hygiene signals

Header analysis alone will not show the segments inside a competitor's list, but it can hint at how thick the segmentation is. Look for multiple Return-Path subdomains used in rotation. A sender whose bounce traffic goes to bnc1.brand.com, bnc2.brand.com and so on is almost certainly running segment-isolated streams so a bad address in one cohort cannot poison the others.

Header order itself is a clue. Message-ID domains that vary subtly by stream suggest the ESP has templated each segment separately. Even Received path fingerprints differ. A customer-service transactional stream tends to terminate on a different IP block than a marketing promo stream, even when both come from the same brand domain. Watch those differences over a quarter and you can sketch a topology of how the rival organises their house list.

Australia's Spam Act makes this mapping especially pointed. Brands cannot legally mail subscribers without consent, which forces cleaner list hygiene than some overseas competitors maintain. A rival whose headers show steady bounce addresses but quick re-engagement flows is probably running the kind of suppression pattern ACMA expects, and that is the standard you should hold your own program to.

Working with Australian delivery and receiving realities

Headers are noisy in Australia because the local filtering stack is loud. Big receiving domains apply their own gating on top of DMARC, and spam filtering at Optus, TPG and Telstra retail customers often relies on heuristics that behave differently from Gmail. When you read a competitor's headers, expect extra Authentication-Results lines from internal scanners, and treat any compauth or mail-checker stamps as informative rather than authoritative.

Some practical adjustments help. Read the local arrival timing rather than the Date header when measuring competitor cadence, because the Date header may be in UTC. Cross-reference with the visible From address and the locale-aware greeting in the body. Anything pointing at .au copy usually means the message was sent during Australian business hours, which raises the chance of an AEST or AEDT send window. Also pay attention to AU-specific unsubscribe syntax: an unsubscribe link pointing to unsubscribe.brand.com.au or to a SaaS endpoint hosted in Australia is a small but real data point about where their customer base sits.

Building a repeatable header-intelligence workflow

The real value of email header analysis is the routine, not the one-off glance. A simple weekly loop runs through four stages: pull the raw headers from five competitor messages, fingerprint the ESP and sending infrastructure, chart cadence by Australian time, and log filter stamps and bounce handlers. Doing this across a quarter produces a denser picture of a competitor's send strategy than any single ESP dashboard, and it costs nothing but a few saved emails.

Tools that make the loop lighter

• Google's MessageHeader tool or the "Show original" view in Apple Mail gives every line you need without paid tooling.
• MXToolbox's header analyser parses Received chains and surfaces routing hops quickly.
• Mailheader.org and Google's Postmaster Tools help when the competitor is large enough to share reputation data.
• A shared spreadsheet with conditional formatting will surface cadence anomalies faster than any dashboard.
• For deeper work, paid tools like GlockApps or Inboxalytics capture send-time deltas across multiple seed accounts.

The trick is patience. Header data only compounds when you revisit the same senders week after week. Within two months you should be able to sketch each major rival's ESP, cadence, segmentation count, and Australian delivery profile, the kind of reverse-engineered competitor email send strategy that informs your own calendar without ever logging into their admin panel.