As illustrated in
Secure Email Gateway Misses
According to common industry practice, informative headers may be added to messages as they pass through an email gateway. Some of the email gateways though which emails pass may be configured to scan for security threats, indicia of spam, or other arbitrary features that may be found in an email. In some environments, the email gateway may provide security features, and is referred to as a Secure Email Gateway.
Some of email gateways may modify the headers or other metadata of an email as they interact with the email. As a non-limiting example, informative X-headers may be added to messages after scanning by a mail gateway. The fields in the headers can help provide administrators with information about the message and about how it was processed
Empirical evidence demonstrates that various gateways from various vendors may insert specifically identifiable information into email headers as those emails are processed. As a result of these changes to email headers, it can be detected if an email has passed through a specific email gateway by performing a pattern match on the headers or other metadata of the email.