How to Read Email Headers: A Complete Guide

Knowing how to read email headers turns an opaque message into a verifiable record of where mail came from and whether it was authenticated. Every email carries a header block — metadata that email servers add as the message travels — and learning to read it lets you trace an email’s path, confirm SPF, DKIM, and DMARC results, and spot signs of spoofing. This guide walks through viewing headers in Gmail, Outlook, and Apple Mail, then reading the fields that matter.

Key takeaways

• Email headers are the metadata servers add as a message travels; reading them lets you trace an email and confirm it was authenticated.
• Read the Received chain from the bottom up — the bottom-most line is the earliest hop, closest to the true sender.
• The Authentication-Results header holds the spf=, dkim=, and dmarc= verdicts the receiving server calculated.
• A mismatch between the visible From address and what authentication verified — especially dmarc=fail — is the clearest sign of spoofing.
• The displayed From is trivial to forge; fields added by trusted receiving servers are not.

What are email headers?

Email headers are the technical metadata attached to the top of every message, in the format defined by the Internet Message Format standard (RFC 5322). Some fields are familiar — From, To, Subject, Date — but the full header block contains far more: every mail server that handled the message, the authentication results receivers calculated, a unique identifier for the message, and the true return address. The message body is what you read; the headers are how the message got to you and whether it can be trusted.

Crucially, some header fields are trivial to forge and others are not. The displayed From address can be set to anything by the sender. Fields added by receiving servers — the authentication results in particular — are far harder to fake, which is why header analysis is central to investigating suspicious mail.

Here is what each of the most important header fields tells you at a glance:

Step-by-Step: How to Read Email Headers in Gmail, Outlook, and Apple Mail

Before any email header analysis, you need the raw headers. Each client exposes them differently:

• Gmail (web): open the message, click the three-dot “More” menu in the top-right of the message, and choose Show original. This displays the full raw message with a summary of SPF, DKIM, and DMARC results at the top.
• Outlook (desktop): open the message in its own window, go to File > Properties, and read the Internet headers box. In new Outlook and Outlook on the web, open the message, choose the three-dot menu, then View > View message source.
• Apple Mail: select the message, then choose View > Message > All Headers (or Raw Source) from the menu bar.

Copy the full block of text. Once you have it, you can read it manually using the sections below, or paste it into an email header analyzer that formats the fields for you.

How to trace an email header back to the sender IP

The Received headers are the heart of how you trace an email. Each server that handles the message adds its own Received line at the top of the header block, so the chain reads in reverse chronological order: the bottom-most Received line is the earliest hop (closest to the sender), and the top-most is the most recent (closest to you).

Read from the bottom up to follow the message’s journey. Each line typically shows which server received the message, from which host and IP address, and a timestamp. Reading in order lets you see the originating infrastructure and every relay in between. Watch for gaps or inconsistencies — large unexplained time jumps between hops, or an originating server that has nothing to do with the claimed sender, are worth a closer look. Remember that a sender can insert fake Received lines near the bottom, but the lines added by trusted receiving servers at the top are reliable.

How to check SPF, DKIM, and DMARC in headers

To check SPF, DKIM, and DMARC in headers, find the Authentication-Results header. The receiving server writes this field after evaluating the message, and it summarizes each authentication check:

• spf=pass / fail: whether the sending server’s IP is authorized to send for the domain in the Return-Path. A pass means the IP is listed in that domain’s SPF record.
• dkim=pass / fail: whether the message carried a valid cryptographic signature that matches a published DKIM key, confirming the signed content was not altered in transit.
• dmarc=pass / fail: whether the message met DMARC alignment — that is, SPF or DKIM passed and the authenticated domain aligns with the visible From domain.

DMARC is the field that ties authentication to the address a recipient actually sees. A message can pass SPF for some unrelated domain yet still fail DMARC because that domain does not align with the From header — a classic spoofing pattern. If any of these terms are unfamiliar, our email authentication guide explains SPF, DKIM, and DMARC in depth, and our DMARC record guide covers alignment and policy in detail.

Manual email header analysis: Essential fields to check

Two more fields complete a solid email header analysis. The Message-ID is a unique identifier assigned when the message is created; its domain often reveals the true originating system and it is useful for correlating a message across logs. The Return-Path (also called the envelope sender or bounce address) is where delivery failures are sent, and it is the domain SPF is checked against — which is why it can differ from the visible From address.

The strongest spoofing signal is a mismatch between what a human sees and what authentication verified. Watch for a friendly From display name whose actual address belongs to an unrelated domain, a Return-Path that does not match the claimed sender, or a dmarc=fail on a message that appears to be from a well-known brand. Any one of these deserves caution; together they are a strong indication of a forged sender. For the wider context on phishing and spoofed mail, see our email security resources, and when a spoofing pattern shows up against a domain you manage, email incident tracking keeps each case as a coherent investigation rather than a one-off alert.

Using an email header analyzer for automated inspection

Email headers can contain sensitive routing details, so where you paste them matters. ToolTrusted’s email header analyzer, available in our email tools, runs entirely in your browser — the header text you paste is parsed locally on your own device and nothing is uploaded to a server. You get a formatted breakdown of the Received chain, the SPF, DKIM, and DMARC results, the Message-ID, and the Return-Path without your data leaving your machine, which makes it safe to use even when investigating a suspicious message. To go beyond a single message and keep an eye on a domain’s authentication posture over time, run a free check on the email health platform.

Frequently asked questions

How do I read the Received chain in an email header?

Read it from the bottom up. Each server adds its Received line at the top of the block, so the bottom-most line is the earliest hop closest to the sender and the top-most is the most recent. Following the lines in order lets you trace the message’s path and spot unexpected servers or timing gaps.

How can I check SPF, DKIM, and DMARC in email headers?

Look for the Authentication-Results header added by the receiving server. It lists spf=, dkim=, and dmarc= results as pass or fail. DMARC also checks that the authenticated domain aligns with the visible From address, which is the key defense against spoofing.

Can email headers be faked?

Some can. The displayed From address and any Received lines a sender inserts before handing off the message can be forged. However, the Authentication-Results and the Received lines added by trusted receiving servers are added after the sender loses control, so they are far more reliable indicators.

Is it safe to paste email headers into an online analyzer?

It depends on the tool. ToolTrusted’s email header analyzer runs entirely in your browser and parses the text locally, so nothing you paste is uploaded to a server. That lets you analyze the routing and authentication details of a suspicious message without your data leaving your device.

What is an email header analyzer?

An email header analyzer parses the raw header block and lays the fields out in a readable format — the Received chain, Authentication-Results, Message-ID, and Return-Path — so you can trace the message and check its SPF, DKIM, and DMARC results at a glance instead of decoding the text by hand. ToolTrusted’s runs entirely in your browser, so the headers you paste never leave your device.