How to Read and Analyse Email Headers

What Email Headers Are

Every email carries a set of headers — lines of metadata added by each server the message passes through. Headers record the route the email took, authentication results, timestamps, and the original sender's information.

How to Access Headers

Gmail: Open email → three-dot menu → "Show original" Outlook: Open email → File → Properties → Internet headers Apple Mail: View → Message → All Headers

Key Headers to Read

Received

Each server that handled the email prepends a Received: header. Reading them bottom to top gives you the message's journey:

Received: from mail.sender.com (203.0.113.1) by mx.example.com
Received: from client.sender.com by mail.sender.com

The oldest Received: header (furthest down) is the original source.

Authentication-Results

Added by the receiving server, this header records SPF, DKIM and DMARC results:

Authentication-Results: mx.example.com;
  spf=pass smtp.mailfrom=sender.com;
  dkim=pass header.d=sender.com;
  dmarc=pass action=none header.from=sender.com

All three passing is the expected result for legitimate email.

Return-Path

The bounce address — where delivery failure notifications go. Should match the From: domain for legitimate senders.

X-Originating-IP

Often added by webmail clients, this reveals the sender's real IP address. Useful for tracing the origin of spam or phishing.

Detecting Spoofed Email

Red flags:

• From: domain does not match Return-Path: domain
• SPF fails or shows softfail
• DKIM absent or invalid
• DMARC fails
• First Received: header originates from an unexpected IP or country
• Reply-To points to a different domain than From

Checking Authentication Results

Use the SPF Checker, DKIM Checker and DMARC Checker to verify the sending domain's configuration independently.