How to Read Email Headers: A Step-by-Step Guide for Non-Techies

Email headers are metadata attached to every email message. They're normally hidden from view but contain a complete technical record of the email's journey: which servers it passed through, when, what authentication it carried, and how spam filters scored it.

Headers are invaluable for diagnosing delivery problems, verifying authentication, and detecting spoofing or phishing attempts.

Each email client hides headers by default but exposes them through slightly different menus.

1. 1

   Gmail

   Open the email → Click the three-dot menu (⋮ More) → 'Show original'. Full raw message opens in a new tab with all headers at the top.

2. 2

   Outlook (web)

   Open the email → Three-dot menu (…) → View → 'View message details'. Headers appear in a dialog box.

3. 3

   Outlook (desktop)

   Open the email → File → Properties → look in the 'Internet headers' text box at the bottom of the dialog.

4. 4

   Apple Mail

   Open the email → View menu → Message → All Headers. Full headers appear in the message pane.

5. 5

   Yahoo Mail

   Open the email → More options (three dots) → 'View raw message'. Raw message opens in a new tab.

Understanding each header type lets you trace exactly what happened to an email.

From:

The displayed sender address shown to recipients. This is user-visible and can be spoofed — it does NOT prove the email actually came from that address.

Return-Path:

The actual envelope sender — where bounce messages and delivery reports go. Compare to From: — a mismatch (e.g., From: ceo@bigbank.com, Return-Path: xz9@random-domain.xyz) is a spoofing indicator.

Received:

Added by every mail server that handled the message. Read from bottom to top: the bottommost is the originating server; the topmost is the final delivery server. Large time gaps indicate delivery delays.

Message-ID:

Unique identifier assigned by the originating server. Format: <uniquestring@originatingserver.domain>. Useful for searching mail server logs and correlating delivery events.

Authentication-Results:

Shows SPF, DKIM, and DMARC results as added by the receiving server. Look for spf=pass dkim=pass dmarc=pass — any fail indicates an authentication problem.

DKIM-Signature:

The actual DKIM cryptographic signature. Contains d= (signing domain — should match From: domain), s= (selector used), and b= (the signature value).

X-Spam-Status:

Added by spam filters like SpamAssassin. Shows whether the email was classified as spam and the numerical score. Example: 'Yes, score=8.5 required=5.0' with a list of triggered rules.

Use these header checks to identify phishing and spoofed email.

• ·From: and Return-Path: domains match — mismatches are a red flag
• ·Authentication-Results shows spf=pass — sending server is authorized by the domain's SPF record
• ·Authentication-Results shows dkim=pass — message signature is valid and unmodified
• ·Authentication-Results shows dmarc=pass — From: domain aligns with authenticated domain
• ·Received: chain originates from expected infrastructure (e.g., Google IPs for Gmail, Microsoft IPs for Outlook)
• ·DKIM-Signature d= matches the From: domain (not a completely different domain)
• ·No unusual X-Originating-IP or X-Forwarded-For headers pointing to unexpected locations