TL;DR: To prove an email was sent, keep the original message as an .eml file, because its headers record the sending servers, the times and usually a DKIM signature from the sender's domain. To prove the email was received, use a registered delivery service, the mail server's delivery log or a TRUE Vault receipt, since a read receipt can be declined. To prove the email was not altered, secure the .eml in TRUE Vault the day it is sent: TRUE Vault anchors its SHA-256 fingerprint on a public blockchain, and anyone can check the file against that record in TRUE Verify, free.
Most business gets done over email. Most disputes do, too.
The moment a deal breaks down, an employee challenges a termination or a client refuses to pay, the emails that led there stop being correspondence and start being evidence. Every assumption gets questioned: "Did you send that?" "Is that what it said?" "How do we know it wasn't edited before you printed it?"
Email was designed for fast communication, not to settle disputes. Nothing in a mailbox proves to a third party that a specific message left your outbox, arrived, and contains the same words and attachments today as it did then. Altered emails and attachments belong to a wider document fraud problem that reaches every kind of business paperwork.
You demonstrate who sent, received or changed a file by answering three separate questions with three kinds of evidence: who sent it and when, whether it reached the recipient, and whether the content is the same today as on the day it was sent. For an email, the original .eml file answers the first, a delivery record answers the second, and an independent fingerprint recorded at the time answers the third. "I have the email" answers none of them on its own.
1. It was sent. When, by whom, from which address.
2. It was received. Did the message reach the recipient's server? Was it opened? Sent and received are not the same thing. Spam folders, server rejections and selective denial all live in the gap.
3. The content has not been altered. Same text, same attachments, same headers. It is the part most people skip, and the one most likely to sink an otherwise strong case, because a printed or forwarded copy can quietly differ from the original.
Most evidence methods answer one or two of the three. Knowing which is which is the difference between proof and a paper trail full of holes.
You prove an email was sent by keeping the original message as an .eml file, which carries the full headers: the Message-ID, a Received line from every server the message passed through and, in most business mail, a DKIM signature from the sending domain. A printout or a PDF of the email loses most of those headers. Export the .eml on the day you send the message, not on the day the dispute starts. An .eml secured in TRUE Vault from TRUE Original the same day gets a proof page that reads "This email was secured by [your name] on [date]", anchored on a public blockchain that neither sender nor recipient controls.
Getting the file takes a few clicks. In Gmail, open the email, click More and choose Download message; Gmail Help says the download is an EML file. In Outlook on the web, More actions and then Download saves the message as an EML or MSG file, according to Microsoft Support. For full threads, export to .eml or PDF.
The headers can be read without downloading anything. In Gmail, click More next to Reply and choose Show original, the route Gmail Help gives for viewing an email's full header. Then compare the Message-ID in your sent copy with the one in the recipient's copy. RFC 5322, the standard for the format of internet email, says the Message-ID "provides a unique message identifier that refers to a particular version of a particular message". The same Message-ID in both copies means both parties hold the same message.
The DKIM signature is what speaks to who sent the email. RFC 6376, the standard that defines DKIM, says it "permits a person, role, or organization that owns the signing domain to claim some responsibility for a message by associating the domain with the message." Since 1 February 2024, Google's email sender guidelines have required everyone sending to Gmail accounts to set up SPF or DKIM, and senders of more than 5,000 messages a day to add DMARC as well. A valid signature ties the message to a domain. It does not tie it to the person at the keyboard.
That gap is where fraud lives. In its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center recorded 24,768 complaints about business email compromise, scams carried out through compromised email accounts, with reported losses of $3,046,598,558. When money moves on the strength of an email, who sent it stops being a formality.
You prove an email was received with a record held outside your own outbox: a registered delivery receipt, the mail server's delivery log, or the recipient's own reply. A read receipt is the weakest of these, because the recipient can decline to send it. In the EU, a qualified electronic registered delivery service carries a legal presumption under the eIDAS Regulation about who sent the data, who received it and when.
Article 43 of Regulation (EU) No 910/2014, the eIDAS Regulation, says that data sent and received through a qualified electronic registered delivery service "shall enjoy the presumption of the integrity of the data, the sending of that data by the identified sender, its receipt by the identified addressee and the accuracy of the date and time of sending and receipt". Data from a registered delivery service that is not qualified still may not be refused as evidence solely because it is electronic.
Server logs expire. Microsoft's Exchange Online documentation, updated in 2026, lets an administrator run a message trace up to 90 days back. Anything older is out of that search's reach.
TRUE Vault adds a third route for a notice that matters. Upload the notice to TRUE Vault, send the proof link to the recipient from TRUE Vault and ask for a receipt. TRUE Vault then records when the file was secured, when the link was sent and when the recipient viewed it.
You get legal proof of email delivery from a record that a third party holds: a registered delivery service, which in the EU carries a legal presumption under eIDAS when it is qualified, or a receipt recorded by TRUE Vault from TRUE Original. A read receipt depends on the recipient, and your Sent folder sits in your own system. Delivery and content are two questions, and a delivery receipt answers only the first.
US law sets out when an email counts as received. Minnesota's enactment of the Uniform Electronic Transactions Act, section 325L.15, says an electronic record is received when "it enters an information processing system that the recipient has designated or uses" for that kind of record, in a form the system can process. It counts as received "even if no individual is aware of its receipt."
The same section draws the line that decides most disputes. An electronic acknowledgment "establishes that a record was received but, by itself, does not establish that the content sent corresponds to the content received."
In the EU, the European standard for these services is ETSI EN 319 522. Its 2024 version defines an Electronic Registered Delivery Service (ERDS) as a service that "provides evidence relating to the handling of the transmitted data, including proof of sending and receiving the data". A qualified one also carries the Article 43 presumption.
For a notice that has to hold up, four steps cover delivery and content together:
The receipt shows the email arrived. The TRUE Vault record shows that the email you put before a court is the email you sent.
No single method proves an email was sent, received and unchanged. Headers and server logs speak to sending, registered delivery and receipts speak to receipt, and only a fingerprint recorded at the time proves the content is unchanged. Screenshots prove the least of all.
Every email carries routing headers: the Message-ID, the SPF, DKIM and DMARC results, and a timestamp from each server hop.
Where headers fall short: Headers are easy to forge in a screenshot, and even the raw .eml that preserves them can be edited in a text editor. The authentication results written into the headers are text like the rest of the file. Without an independent record of what the file looked like at the time of sending, headers prove the routing of whatever file you're holding now, not what was sent.
Where forwarding falls short: A forwarded copy proves you had a copy when you forwarded it. It says nothing about whether the original was changed before that, or about what the recipient received. It is a record made by one party, on a system that party controls.
Where read receipts fall short: Recipients can decline them, mobile clients often ignore them, and even when one comes back it proves the email was opened, not that the contents are unchanged. A read receipt is a weak signal of delivery and no proof of content.
Certified mail is a physical postal service producing a paper receipt that a letter was sent and delivered. Many jurisdictions have a certified email standard, operated by trusted third parties and producing statutory delivery proof courts and regulators accept directly. In the EU the legal term is electronic registered delivery service, and a qualified one carries the legal presumption in Article 43 of eIDAS.
Where registered email falls short: Strong for sending and delivery, with practical constraints: typically locked to one country or provider ecosystem, often requiring accounts or national IDs on both sides, priced per message, and expensive at volume. What it certifies (body, envelope, attachments) varies by provider. For proof of content that anyone can check outside the provider's system, it may not be enough on its own.
Where screenshots fall short: A screenshot is the weakest form of email evidence and the easiest to fabricate. Courts increasingly view screenshots with skepticism unless corroborated by the actual file. Under US Federal Rule of Evidence 901, the party offering an item "must produce evidence sufficient to support a finding that the item is what the proponent claims it is", and a picture of a mailbox gives that finding very little to stand on. Use screenshots as a convenience for yourself, not as evidence for a third party.
Where server logs fall short: Logs require admin access, and they are kept for a limited window: Microsoft's 2026 documentation for Exchange Online allows a message trace up to 90 days back. The longer the gap between the email and the dispute, the smaller the chance the log still exists. Logs also live inside the system of the party producing them, which a counterparty can challenge.
A quick comparison:
| Method | Sent | Received | Content unchanged | Independently verifiable |
|---|---|---|---|---|
| Email headers (raw .eml) | Partial | Partial | No | No |
| Forward to yourself | No | No | No | No |
| Read receipts | Indirect | Yes (if returned) | No | No |
| Registered email | Yes | Yes | Sometimes | Within provider system |
| Screenshots | Weak | No | No | No |
| Server logs | Yes (while retained) | Yes (while retained) | Partial | Requires admin access |
| TRUE Vault (.eml fingerprint on blockchain) | Existed at the time secured | Yes, with a TRUE Vault receipt | Yes | Yes, in TRUE Verify |
None of these is wrong. Each is partial. The strongest packages combine more than one and add an independent, time-anchored record of the content itself. The same trade-offs apply to any document, as the comparison of paper, PDF and blockchain-secured documents shows.
You prove an email was not altered by recording a cryptographic fingerprint (a SHA-256 hash) of the original .eml file at a known moment, in a place neither party controls, and comparing the file against it later. If one byte of the email changes, the fingerprint changes. A public blockchain is such a place: the fingerprint and its timestamp sit on infrastructure that no single party can rewrite. TRUE Vault, part of TRUE Original, does this for any .eml file: it anchors the file's SHA-256 fingerprint on a public blockchain, and anyone can drop the same file into TRUE Verify, free and without an account, to see whether it is unchanged or changed.
US federal courts already authenticate digital files this way. In its 2017 note to Federal Rule of Evidence 902(14), the US Advisory Committee on Evidence Rules wrote that electronic files "are ordinarily authenticated by 'hash value'" and that "If the hash values for the original and copy are the same, it is highly improbable that the original and copy are not identical."
The mechanism for an email takes three steps:
Anyone (opposing counsel, a regulator, an arbitrator, a future you) can compare the .eml in your possession with the blockchain record. Change one byte and the fingerprints no longer match. If they match, you have independent proof that this exact file existed at this exact time, unchanged since.
That proof is not held by you and not by your email provider. It is anchored on public infrastructure that no single party controls, and that independence is what gives it evidentiary weight.
Yes, emails can be used as evidence in court, and the court decides how much weight a particular email deserves. In the US, Federal Rule of Evidence 901 requires the party offering an email to "produce evidence sufficient to support a finding that the item is what the proponent claims it is." In the EU, the eIDAS Regulation says electronic timestamps and registered delivery data shall not be denied admissibility as evidence solely because they are electronic.
Weight builds in layers. The raw .eml with intact headers beats a screenshot or a forwarded copy, a delivery record covers receipt, and an independent timestamped fingerprint covers the content. Admissibility rules vary by jurisdiction, so a lawyer should judge the specifics of your case.
Yes, an electronic timestamp counts as evidence under eIDAS. Article 41 of Regulation (EU) No 910/2014 says "An electronic time stamp shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements of the qualified electronic time stamp." A qualified electronic timestamp, issued by a qualified trust service provider, goes one step further and carries a legal presumption that its date, time and data integrity are accurate.
The regulation defines an electronic time stamp as "data in electronic form which binds other data in electronic form to a particular time establishing evidence that the latter data existed at that time". For how a blockchain anchor and a qualified timestamp fit together, read are blockchain timestamps eIDAS qualified timestamps?
TRUE Vault proves an email was not altered by anchoring the SHA-256 fingerprint of the .eml file on a public blockchain the moment you secure it, and giving you a permanent proof URL. Anyone can later drop the same file into TRUE Verify, free and without an account, and see whether it is unchanged or changed. TRUE Vault is part of the TRUE Original platform, and the proof sits on the blockchain itself, not with TRUE.
1. Download the email as an .eml file. Gmail, Outlook, and Apple Mail can save a message as .eml, the format that preserves headers, body, and attachments together. Gmail (Download message) and Outlook (Download, or Save as) both do it in a few clicks.
2. Drop the .eml into TRUE Vault. The file is hashed in your browser, so only the fingerprint reaches TRUE's servers. TRUE Vault anchors that fingerprint on blockchain with a fixed date and time.
3. Receive your proof URL. A permanent, shareable link: the proof page reads, "This email was secured by [your name] on [date]". Verifiable by anyone, forever.
4. Share it on your terms. Make the link public, private or password-protected. Send it from TRUE Vault to a named recipient and ask for a receipt, and TRUE Vault records when the recipient viewed the file.
5. Verify at any time. Opposing counsel, an arbitrator or a regulator can check the .eml in TRUE Verify. No account, no cost. The record lives on the blockchain, not on TRUE's servers, so every proof link keeps working even if the TRUE Vault app one day does not.
A TRUE Vault proof establishes three facts:
The claim is narrow on purpose. The narrower the claim, the stronger the proof. And the sooner an email is secured after it is sent, the less room anyone has to argue: a demand letter secured the same afternoon leaves no gap to fill.
Proof that an email was not altered decides a dispute when both sides agree an email exists but disagree about what it said or what was attached. In that situation, an .eml secured in TRUE Vault on the day it was sent fixes the wording, and the argument moves on to the facts. Four situations show the pattern.
A lawyer sends a formal demand letter by email. Weeks later, the recipient produces a different version, or denies receiving it. With the .eml secured the day it was sent, the sender can show the exact contents and timestamp of the original. Receipt is a separate question, settled by a registered delivery receipt or a TRUE Vault receipt. What was written is no longer arguable.
A vendor delivers a contract with a signed PDF attached. Months later, the counterparty disputes a clause and claims the attachment "wasn't in that version." The sender secured the original .eml (headers, body and attachment) the moment it was sent. The exact attachment is provable, byte for byte.
An HR manager sends a termination email with precise terms of separation. The former employee later claims it said something different. The original .eml, secured at the moment of sending, locks the wording, date, time, sender, recipient and any attached documents.
A vendor sends a written quote by email. Later the vendor raises the price, claiming the original quote was different. The buyer secured the .eml the day it arrived. The proof page shows that this exact quote, with these exact numbers, was in the buyer's possession on that date.
In each case, a registered delivery service could prove delivery and server logs could corroborate routing. The blockchain timestamp adds proof of the content itself, which anyone can check.
A complete email evidence package answers all three questions at once: the original .eml with intact headers shows who sent the email and when, a delivery record shows it arrived, and a TRUE Vault proof shows the content has not changed since the day it was secured. Whether the statements inside the email are true is a separate question, which a court weighs on the content, exactly as it would with a signed paper letter. The package makes sure both sides are arguing about the same words.
A demand letter secured the day it is sent is stronger evidence than one secured a month later, when the other side has had a month to raise doubts.
An organisation that sends notices, contracts, certificates or diplomas by email should secure each document at the moment it is issued, not after a dispute starts. TRUE Vault's Enterprise plan is built for that volume, with verified post that replaces registered mail and an API for high-volume automation. For diplomas, certificates and licences, TRUE Original issues every document blockchain-secured from the start, so any recipient or employer can check it in TRUE Verify.
A school that emails diplomas faces the mirror image of the email question. The issue is rarely whether the email arrived. It is whether the diploma a graduate shows an employer five years later is the one the school issued.
Download the email as an .eml file and drop it into TRUE Vault: the proof URL comes back in about a minute, and the free plan needs no credit card. Securing an .eml takes about a minute. The first file is free. Do it the day the email is sent. If someone sent you an email or attachment and you want to know whether it matches a secured original, drop the file into TRUE Verify, which returns unchanged or changed.
Change one comma in the .eml, and the answer is changed.
Keep the original email as an .eml file, whose headers record the sending servers, the times and usually a DKIM signature from your domain, and secure it in TRUE Vault the day you send it so the content can be shown unchanged. For proof of sending and receipt with legal weight, use a registered delivery service: in the EU, a qualified electronic registered delivery service carries a legal presumption under Article 43 of the eIDAS Regulation.
Yes, emails can be used as evidence in court, and the court decides how much weight a particular email deserves. A raw .eml file with intact headers weighs more than a screenshot or a forwarded copy, and a delivery record plus an independent blockchain timestamp of the .eml strengthen it further. Admissibility rules vary by jurisdiction, so ask a lawyer about your own case.
Use a record held outside your own outbox: a registered delivery receipt, the mail server's delivery log, or a TRUE Vault receipt that records when the recipient viewed the file. A read receipt is weak evidence of delivery, because the recipient can decline to send it.
Yes. Headers in a screenshot are easy to fake, and anyone holding the raw .eml file can edit it in a text editor, including the SPF, DKIM and DMARC results written into the headers. A fingerprint of the .eml recorded at the time, such as a TRUE Vault proof, shows whether a single byte has changed since.
Secure the whole .eml file, because it packages headers, body and attachments together and one SHA-256 fingerprint covers all of them. If the recipient later claims a different attachment was sent, the exact .eml can be checked against the blockchain record in TRUE Verify, byte for byte.
Drop the .eml file into TRUE Verify, free and without an account. If the email was secured in TRUE Vault, TRUE Verify reports whether the file is unchanged or changed since the moment it was secured.
Get legal proof of email delivery from a record a third party holds: a registered delivery service, which in the EU carries a legal presumption under eIDAS when it is qualified, or a receipt recorded by TRUE Vault from TRUE Original. A delivery receipt proves the email arrived, and a TRUE Vault record of the .eml proves what the email said.
TRUE Original, Stockholm. Secure digital documents since 2020. eIDAS compliant. Over 900,000 documents issued for more than 200 organisations in over 15 countries.
Informational, not legal advice. Email admissibility varies by jurisdiction; consult a qualified lawyer for any matter that matters.
Every organisation we work with started with the same question. Give us thirty minutes and we will show you what your own documents would be worth.
Book a callNot sure where to start? Let us help!
Trusted by leading organisations worldwide
