Email Headers: What They Are and How to Read Them

Short answer: Email headers are the lines of metadata at the top of every message: who sent it, who it was addressed to, when, and which servers handed it along. Your email app shows only a few of them (From, To, Date, Subject). To see the full header, use Show original in Gmail, View message details in Outlook, or View > Message > All Headers in Apple Mail. Paste it into a header analyzer such as Google's Messageheader tool to check where a message really came from and whether it passed SPF, DKIM and DMARC.

What are email headers?

Every email has two parts: the header and the body. The format is set by RFC 5322, the Internet standard for email messages. Each header line is a field name, a colon and a value, for example Subject: Lunch on Friday?. Some fields are written by the sender's email app. Others are added by servers along the way.

Two details from the standard surprise people. First, only two fields are actually required: Date and From. Everything else, even To and Subject, is optional. Second, servers that pass a message along add their own "trace" fields to the top of the header, which is why the newest routing information always sits above the oldest.

That's why headers are often called email metadata: information about the message, not the message.

The header fields that matter

A full header can run to dozens of lines. These are the ones worth knowing:

Field	What it tells you	Who adds it
From	The sender's name and address as shown to you. Easy to fake.	Sender's email app
To, Cc	Who the message was addressed to. Bcc recipients never appear.	Sender's email app
Subject, Date	The subject line and the time on the sender's clock	Sender's email app
Reply-To	Where replies go, if different from From	Sender's email app
Message-ID	A unique ID for this message, usually including the sending domain	Sender's app or server
Return-Path	The address that receives bounces	Receiving server, at final delivery
Received	One line per server hop: who handed the message to whom, and when	Each server along the way
DKIM-Signature	A cryptographic signature from the sending domain	Sending server
Received-SPF	The result of an SPF check on the sending server	Receiving server
Authentication-Results	SPF, DKIM and DMARC results in one place (pass, fail and so on)	Receiving server

One correction to a common claim, which our old version of this page also made: "SPF" is not a header field. SPF is a DNS record the sending domain publishes. What you see in a header is the result of checking it, in a Received-SPF line or inside Authentication-Results.

How to view the full email header

Every major email app hides the full header by default. Here's where to find it:

Gmail

Open Gmail in a browser and open the message.
Next to Reply, click More (three dots), then Show original.
The full header opens in a new tab. Click Copy to clipboard if you want to paste it into an analyzer.

Outlook.com, Outlook on the web and new Outlook

Open the message and select More actions (three dots) at the top of the message.
Select View > View message details.

In classic Outlook for Windows, double-click the message to open it in its own window, then choose File > Properties. The header is in the Internet headers box.

Apple Mail on Mac

Open the message and choose View > Message > All Headers. View > Message > Raw Source shows the complete message, body included. Our guide to showing full headers in Apple Mail also covers choosing which headers Mail displays every time.

How to read an email header

You don't need to understand every line. To check whether a message is what it claims to be, work through these in order:

Find Authentication-Results. Look for spf=, dkim= and dmarc=. A pass on all three, for the domain shown in From, is a good sign. A fail or none on a message that claims to be from your bank is a red flag.
Compare From, Reply-To and Return-Path. If the message says it's from a well-known company but replies go to a free webmail address or an unrelated domain, be suspicious.
Read the Received lines from the bottom up. The lowest one is the earliest hop, the top one is your own provider accepting the message. The times between hops also show where a delay happened.
Check the Message-ID domain. It usually matches the service that sent the message. A mismatch isn't proof of anything, but it adds to the picture.

One caution: Received lines added before the message reached your provider can be faked. Trust the ones your own provider added, near the top.

Email header analyzers

A raw header is hard to read: long lines, time zones that don't match, base64-looking signatures. An email header analyzer takes the pasted header and lays it out as a table of hops, delays and authentication results. None of them can tell you more than the header contains, but they save a lot of squinting.

Google Admin Toolbox Messageheader. Google's own help page recommends it: copy the header from Show original, paste it in and click Analyze the header above.
Message Header Analyzer (mha.azurewebsites.net), another free web tool that does the same job.
MxToolbox Email Header Analyzer, which also parses the header into hops and checks.

These tools parse the text you paste. Still, a header holds addresses and server names, so strip anything sensitive before pasting it into a site you don't know.

Using headers to spot phishing and spoofing

Spoofing means faking the From address, and it's the reason headers matter to ordinary users. Microsoft's own guidance is to check the header when a sender looks wrong, find the real address, and block it. The usual giveaways:

From shows a familiar brand, but SPF, DKIM or DMARC fails or is missing.
Reply-To points somewhere other than the sender.
The first Received hop comes from a server that has nothing to do with the company named in From.

Headers are one clue among several. A message can pass every check and still be a scam sent from a lookalike domain the attacker registered, so read the domain itself carefully too. For the full checklist, see our guide to spotting and reporting phishing emails.

Headers and email deliverability

If you send email and your messages land in spam, the header of a test message tells you why more often than not. Send one to a Gmail or Outlook.com address, open the full header, and look at Authentication-Results. A failing SPF or DKIM result, or a missing DMARC policy, is the first thing to fix in your domain's DNS settings.

Protection that doesn't need you to read headers

Disclosure: we make Canary Mail. Most people will never open a raw header, and they shouldn't have to. Canary Mail's Pro+ plan ($100 a year) includes phishing and impersonation detection, plus PGP and SecureSend for encrypted mail. Tracker blocking is on by default on every plan. Canary works with Gmail, Outlook, iCloud, Yahoo, Exchange and other IMAP accounts on Mac, iPhone, iPad, Windows and Android, and more than 2 million people use it.

Frequently asked questions

What information is in an email header?

The sender and recipients, the date, the subject, a unique Message-ID, the path the message took through mail servers (the Received lines) and the results of authentication checks such as SPF, DKIM and DMARC. Bcc recipients are never listed.

How can I view all email headers in Outlook?

In Outlook.com, Outlook on the web and new Outlook, open the message, select More actions, then View > View message details. In classic Outlook for Windows, open the message in its own window and choose File > Properties; the header is in the Internet headers box.

Can email headers be faked?

Partly. The sender controls the From, Reply-To and Subject fields and can add fake Received lines. What they can't easily fake are the lines your own provider adds on arrival, including the Authentication-Results line, which is why that's the place to look first.

Does an email header show the sender's IP address?

It usually shows the IP addresses of the mail servers that handled the message, in the Received lines. Whether the sender's own device appears depends on the provider and how the message was sent, so a header rarely pinpoints a person.

What is an email header analyzer?

A free tool that takes a pasted header and turns it into a readable table of server hops, delays and SPF, DKIM and DMARC results. Google's Admin Toolbox Messageheader, Message Header Analyzer and MxToolbox are common ones.

Sources

Catch phishing before you click

Download Canary Mail

Email Headers: What They Are and How to Read Them (2026)