How to Read an Email Header (and Why It Helps)

Every email carries a hidden section called the header - a technical record of where the message came from, the route it travelled and whether it passed authentication. Knowing how to read it helps you spot spoofing, diagnose delivery problems and verify a suspicious message. Here is a plain-English guide.

What is an email header?

The header is the metadata at the top of every email, mostly hidden by your mail app. While the body is the message you read, the header records the technical details: sender, recipient, servers involved, timestamps and security results.

How to view it

The steps vary by app, but look for an option like "Show original," "View source," or "View headers" on an open message. You will see a long list of lines like From:, Received:, and Authentication-Results:.

The key lines to know

• From / Return-Path - the claimed sender and the actual bounce address. If these disagree with each other or with the "friendly" name, be suspicious.
• Received - a stack of lines showing each server the message passed through, newest at the top. Read bottom-up to trace the real origin.
• Authentication-Results - the most useful line for security. It shows whether the message passed SPF, DKIM and DMARC. pass is good; fail on a message claiming to be from a known brand is a red flag.
• Message-ID - a unique identifier, useful when reporting or tracing a specific message.
• Date - when it was sent.

Using headers to spot spoofing

If an email claims to be from your bank or a colleague but the Authentication-Results show SPF/DKIM/DMARC fail, or the Received chain starts somewhere unexpected, it is very likely spoofed. This is exactly what proper domain authentication is designed to expose - see what is email spoofing and how to prevent it and, for the human signs, how to spot a phishing email.

Using headers to diagnose delivery

Slow email? The timestamps in the Received chain show where a message paused - useful for spotting delays (for example, a brief hold from greylisting). Bounce headers also carry the reason a message failed - see email bounce messages explained.

You rarely need to do this by hand

Reading headers is a handy skill, but a good email platform does the heavy lifting - checking authentication, filtering spoofed mail and surfacing problems for you. DigiCloudMail authenticates and filters every message so you rarely have to dig into a header at all.

Want email that catches spoofing before it reaches you? Get in touch.