What is “X-Mailer” or “User-Agent”?

X-Mailer and User-Agent are optional email headers that name the software that built the message. X-Mailer typically appears on messages composed by mail clients (Outlook, Apple Mail, older webmail), and User-Agent is the version originally borrowed from HTTP and used by clients like Thunderbird and Mutt. Both do the same job: they tell anyone reading the raw headers what wrote the email.

A few real examples you will see in raw source:

• X-Mailer: Microsoft Outlook 16.0
• User-Agent: Mozilla Thunderbird/115.6.0
• X-Mailer: Apple Mail (2.3774.500.171.1.1)
• X-Mailer: Mailchimp Mailer - **CIDxxxxxxxxxx**
• User-Agent: Roundcube Webmail/1.6.5

Neither header is required. RFC 5322 lists the headers an email must or may have, and X-Mailer is not on the list. It is a custom header, which is what the X- prefix historically meant. RFC 6648 formally retired the X- convention back in 2012, but the headers that already existed before then, including X-Mailer, stuck around because every mail client on earth was already writing them.

What they are actually useful for

Debugging. When you are staring at a weirdly broken message - garbled characters, a busted multipart boundary, an inline image that renders as an attachment - the first thing I look at is X-Mailer. If the sender is on some obscure CRM that wrote its own SMTP code in 2014, that explains a lot. If it is plain Outlook, the bug is probably in your template or your ESP's MIME builder, not the client.

Identifying the source. Most ESPs stamp their own value. Mailchimp writes Mailchimp Mailer. Constant Contact, SendGrid, HubSpot all leave fingerprints somewhere in the headers, sometimes in X-Mailer, sometimes in Received lines or custom X- headers. If you are doing competitive teardown of a marketing email, the header block tells you who is sending it before you read a single word of body copy.

Weak filtering signal. Spam filters look at X-Mailer the way a bouncer looks at your shoes: it is not the deciding factor, but a X-Mailer: PHPMailer 5.2.9 from a residential IP raises the same eyebrow as flip-flops at a wedding. Known-bad mailer strings used by spam tools get scored down. Missing the header entirely is normal and fine. A blatantly forged value (claiming to be Outlook while sending through a Mailchimp SMTP server) can also score against you because authenticated mail providers like Google flag mismatches between the claimed client and the actual sending path - their guidelines on this live in the Gmail sender requirements.

What they will not do for you

These headers are not authentication. Anyone can write whatever string they want. You cannot trust X-Mailer: Microsoft Outlook to mean the message actually came from Outlook, the same way you cannot trust a From: address without checking SPF, DKIM, and DMARC. If a forensic question matters, ignore X-Mailer and look at Received lines, Authentication-Results, and the signing domain in DKIM.

They also do not affect deliverability on their own. I have seen people strip X-Mailer for "privacy" and worry it will hurt inboxing. It will not. Gmail, Yahoo, and Microsoft do not penalise missing optional headers. What does matter is whether you are authenticated, whether your IP and domain have a track record, and whether people complain about your mail.

What to do as a sender

If you are sending through an ESP, you do not need to touch this. The ESP sets it, and removing it would require either custom SMTP code or a configuration option most providers do not expose. Fine, leave it.

If you are running your own sending pipeline or a custom mail relay, pick one: either set a clear, consistent X-Mailer (your product name plus a version) or omit it entirely. Do not flip between values across mailings from the same stream - consistency is the thing filters notice, not presence or absence.

If you are debugging someone else's mail, view full source, grep for X-Mailer and User-Agent, and use it as a clue, not a conclusion.