How to Read Email Headers: A Beginner's Guide
Every email carries a block of technical metadata that's normally hidden from view — the headers. Most people never see them, and most of the time you genuinely don't need to. But when something's genuinely wrong — a suspicious message, a delivery mystery — headers are where the actual answers live.
How to view them
Every provider hides this somewhere slightly different, usually under a message's options menu — look for wording like "Show original," "View source," or "Show headers." Once you're doing this for a specific reason, our Header Analyzer tool can parse it for you automatically rather than reading it line by line.
The parts actually worth understanding
From, To, Subject, Date
The visible fields you already know — these aren't hidden, but they're technically part of the header block too.
Received
This is the delivery trail — each mail server the message passed through adds its own "Received" line, stacked in order. Reading from the bottom up shows the message's actual journey from the original sending server to your inbox. If a message claims to be from one company but the Received chain shows servers with no connection to that company at all, that's a red flag worth taking seriously.
Authentication-Results
This is where SPF, DKIM, and DMARC results actually show up — each one marked pass or fail. If you're trying to figure out why a message you sent got flagged as spam, or whether a suspicious message is legitimate, this line usually has the clearest answer. See our SPF/DKIM/DMARC explainer for what each of those three actually checks.
Return-Path
The address bounce notifications actually go to — not always the same as the visible "From" address, which is worth knowing when a bounce doesn't seem to match what you'd expect.
Message-ID
A unique identifier assigned to the message by the sending server. Mostly useful for tracking down a specific message when working with a provider's support team — not something you'll need to interpret yourself.
What most people don't need to worry about
There's a lot of additional technical detail in a full header block — MIME boundary markers, content-type declarations, various X-headers specific to individual mail systems. Unless you're doing deep technical troubleshooting, these are safe to skip entirely. The Received chain and Authentication-Results line cover the overwhelming majority of what people actually need headers for.