You don't mention your operating system, or how the mail is normally delivered. I run (as a cron job) a script combining Net::POP3, which gets the mail, and Email::Filter, which I use to sort and log incoming mail. Email::Filter provides access to the header fields. You might also put a script with Email::Filter into your .forward file.