How to read e-mail headers: where did a message really come from?

Every e-mail carries a résumé that your mail program normally hides: the header. It records which servers the message passed through, when it arrived where, and whether the checks against forged senders passed. If you can read a header, you spot phishing faster and find out why a mail was late or ended up in spam.

Where to find the header

Every mail program can show the full header; it just calls the feature something different:

• Gmail: open the message, click the three dots at the top right and choose "Show original".
• Outlook on the web: three dots, then "View" and "View message details".
• Outlook for Windows: "File", "Properties", section "Internet headers".
• Apple Mail: "View", "Message", "All Headers".
• Thunderbird: "View", "Message Source".
• TossPost: in every message, the "Headers" tab shows all lines and "Source" the full raw text.

The lines that matter

A header consists of many lines of the form Name: value. For most questions, these are enough:

Line	What it tells you
From	The displayed sender. Can be set to anything.
Reply-To	Where a reply goes. In scams often a different address than From.
Return-Path	Where bounce messages go; this is the address SPF checks.
Date	When the sender sent the mail, according to their own clock.
Message-ID	A unique identifier, usually containing the domain of the sending system.
Received	One stop on the mail's route. There are usually several.
Authentication-Results	The outcome of SPF, DKIM and DMARC at the receiver.
DKIM-Signature	The digital signature and the domain that signed (d=).
List-Unsubscribe	The unsubscribe link of newsletters.

Tracing the route of a mail

Every server that passes a mail on adds a new Received line at the top of the header. So you read the route from the bottom up: the lowest line is the first stop, the top one the last before your inbox.

Received: from mail.example.org (mail.example.org [198.51.100.7])
        by mx.example.net with ESMTPS; Tue, 20 Oct 2026 09:14:05 +0200
Received: from app-3.internal.example.org (10.0.0.12)
        by mail.example.org with ESMTP; Tue, 20 Oct 2026 09:14:02 +0200

Here an internal application server handed the mail to the mail server of example.org, which sent it on to the receiver example.net three seconds later. Compare the timestamps of consecutive stops and you see where a mail got stuck. If minutes or hours pass between two lines, that stop caused the delay.

Spotting a forged sender

Phishing mails pose as a bank, a parcel service or a colleague. The header often gives them away:

• Authentication-Results shows fail: if DMARC fails although the mail claims to come from a large company, that is a clear warning sign.
• From, Reply-To and Return-Path do not fit together: a mail "from your bank" whose reply address sits at a free mail provider is suspicious.
• The display name deceives: From: "Bank Support" <[email protected]> – what counts is the address in angle brackets, not the name in front of it.
• Strange servers on the route: if a mail supposedly comes from a company but the lowest Received line names a server that has nothing to do with it, something is off.

No single sign proves a scam. But when several apply, do not click any link and do not open attachments.

What the header does not tell you

The header is revealing, but it is no lie detector:

• Only the top lines are reliable. The Received lines your own mail provider added are true. Anything below can have been written by the sender.
• The sender's location usually stays hidden. Large webmail services do not pass on their users' IP addresses, and a server IP only tells you where the data center is.
• Date is the sender's claim. A wrong clock or intent can falsify it; the timestamps of the Received lines are more reliable.

Reading headers faster

A long header with dozens of lines is tedious to read. The TossPost header analyzer does it for you: paste the header and you see the stops of the mail in the right order with the delays between them, the outcome of SPF, DKIM and DMARC, whether the domains match the sender, spam flags and the unsubscribe link. The header is only used for the analysis and not stored.

To find out how your own mail arrives, send it to the mail tester. The article SPF, DKIM and DMARC explained covers what is behind the checks.

In short

The header shows where a mail comes from, which route it took and whether it passed the checks against forgery. Read the Received lines from the bottom up, compare From, Reply-To and Return-Path, and look at Authentication-Results.

Analyze a header now