What are email headers?
Every email has two parts: the headers and the body. The body is the content you see — the message, images, and links. The headers are metadata attached to the email that describe where it came from, how it got to you, and whether it passed authentication checks. Headers are like a shipping label on a package. The recipient doesn’t usually look at them, but they contain all the routing and verification information.How to view email headers
Gmail
- Open the email
- Click the three dots menu (top right)
- Click Show original
Outlook
- Open the email
- Click File > Properties
- Headers are in the Internet headers box
Apple Mail
- Open the email
- Click View > Message > All Headers
Key headers
From
The visible sender address. This is what the recipient sees in their inbox.The
From header can be spoofed — anyone can set it to any address. This is why authentication protocols (SPF, DKIM, DMARC) exist.To
The recipient’s address.Subject
The email subject line.Date
When the email was sent.Message-ID
A unique identifier for the email. No two emails should have the same Message-ID.Reply-To
The address that receives replies. Can be different from theFrom address.
Return-Path
The envelope sender — where bounce notifications are sent. This is what SPF checks against (not theFrom header).
Received
The most important header for debugging. Each mail server that handles the email adds aReceived header. They’re read bottom to top — the bottom one is the first server, the top one is the last.
- from — the sending server (
send.acme.com) - by — the receiving server (
mx.google.com) - with ESMTPS — the connection used TLS encryption
- for — the recipient
- timestamp — when this hop occurred
Authentication-Results
Added by the recipient’s mail server. Shows the results of SPF, DKIM, and DMARC checks.DKIM-Signature
The DKIM signature added by the sending server.List-Unsubscribe
Tells email clients how to let the recipient unsubscribe. Gmail and other providers show an “Unsubscribe” link next to the sender name when this header is present.Reading headers for debugging
When debugging delivery issues, focus on these headers in order:1. Authentication-Results
Are SPF, DKIM, and DMARC all passing? If any showfail, that’s likely your problem.
2. Received headers
Read bottom to top. Check the timestamps to find delays. If there’s a large gap between twoReceived headers, that hop is where the delay occurred.
3. X-Spam headers
Some providers add headers indicating spam scoring:4. DKIM-Signature
If DKIM is failing, verify thed= (domain) and s= (selector) values match your DNS record.
FAQ
Can email headers be faked?
Can email headers be faked?
Some headers can be set by the sender (
From, Reply-To, Subject). But headers added by receiving servers (Received, Authentication-Results) are trustworthy because they’re added after the email is received. This is why authentication checks are important — they verify the headers that the sender controls.Why are there multiple Received headers?
Why are there multiple Received headers?
Each mail server that processes the email adds its own
Received header. An email typically passes through 2–4 servers: the sending server, possibly an intermediary, and the recipient’s server(s). Each hop adds a header.What does 'ESMTPS' mean vs 'ESMTP'?
What does 'ESMTPS' mean vs 'ESMTP'?
ESMTPS means the connection used TLS encryption. ESMTP means no encryption. In the
Received header, this tells you whether that hop was encrypted.