An Email Header contains critical metadata that accompanies every email sent across the internet. While standard mail clients usually hide this information to show only the sender, recipient, subject, and date, the full header contains the complete trace of every server, IP address, and security check the email passed through from sender to recipient.
Analyzing raw email headers is essential for investigating email delivery delays, spoofing attempts, spam classifications, and authentication failures.
Email headers consist of standard key-value pairs formatted as Header-Name: Value. They are appended sequentially as an email travels across the network, meaning the newest routing information appears at the top, while the original sending server details appear at the bottom.
| Header Tag | Description | Example |
|---|---|---|
| Received: | Added by each mail transfer agent (MTA) that handles the message. Contains IP addresses, timestamps, and TLS details. | Received: from mail.example.com (mail.example.com [192.0.2.1]) … |
| Authentication-Results: | Summary of authentication checks performed by the receiving server (SPF, DKIM, DMARC). | dkim=pass header.i=@example.com header.s=s1; dmarc=pass … |
| DKIM-Signature: | Cryptographic signature verifying message integrity and domain authenticity. | v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=s1; … |
| From: | The address displayed to the recipient (Header From). | John Doe john@example.com |
| Return-Path: | The actual envelope sender address used for delivery error notifications and bounces. | bounces@example.com |
| Message-ID: | A unique string generated by the originating server to identify the message. | 20260803.123456@mail.example.com |
| X-Forefront-Antispam-Report: / X-Spam-Status: | Custom spam and threat filtering scores added by security gateways. | SCL:1; SRV:BULK; CAT:NONE |
To trace the route an email took, read the Received: headers from bottom to top:
[Hop 3 - Top / Newest]
Received: from mx.google.com (mx.google.com. [172.217.215.27])
by inbound-smtp.gmail.com with SMTP id x123
for <user@gmail.com>; Mon, 03 Aug 2026 12:00:02 -0000
[Hop 2 - Middle]
Received: from relay.telenegar.ir (relay.telenegar.ir [198.51.100.10])
by mx.google.com with ESMTP id y456
for <user@gmail.com>; Mon, 03 Aug 2026 12:00:01 -0000
[Hop 1 - Bottom / Origin]
Received: from mail.example.com (mail.example.com [192.0.2.1])
by relay.telenegar.ir with ESMTP id z789
for <user@gmail.com>; Mon, 03 Aug 2026 11:59:58 -0000
Received: header shows the true originating IP address of the sender (`192.0.2.1` in the example above), regardless of what is written in the From: line.| Email Client | Instructions |
|---|---|
| Gmail | Open email → Click three dots (More) next to Reply → Click “Show original”. |
| Microsoft Outlook (Desktop) | Open email → Go to File → Properties → Copy text from Internet headers. |
| Outlook Web (OWA) | Open email → Click three dots (…) menu → View → View message details. |
| Apple Mail | Open email → Go to View menu → Message → Raw Source (or `Cmd + Option + U`). |
| Thunderbird | Open email → Go to View → Message Source (or `Ctrl + U`). |
If an email claims to be from `support@bank.com`, but the bottom Received: header shows an unrelated IP address or domain, the message is likely spoofed. Check the Authentication-Results line for `spf=fail` or `dmarc=fail`.
If an email arrived 30 minutes late, inspect the timestamps across all Received: hops to identify which specific MTA delayed processing or greylisted the connection.
If emails bounce with 5xx status codes, inspect the Return-Path and Received-SPF headers to ensure SPF alignment isn't broken during forwarding.
You can verify and test your email headers and infrastructure using Telenegar Tools: