How to Read Email Headers
Learn how to find and read the raw headers of an email — trace its delivery path, spot delays, and check whether it's authentic or spoofed.
By the ToolsHub team · Updated May 1, 2026
Every email carries a hidden trail of headers recording each server it passed through. Reading them tells you where a message was delayed, and whether it's genuinely from who it claims. Paste them into our Email Header Analyzer to see it all laid out.
Finding the raw headers
- Gmail — open the message, the ⋮ menu, then "Show original".
- Outlook — File, Properties, and copy the Internet headers box.
- Apple Mail — View, Message, then "All Headers".
What the headers tell you
Received headers are added by each server as the message travels, newest first — read them bottom-up to follow the journey in order. A large time gap between two hops shows where the message sat. The Authentication-Results header holds the receiver's SPF, DKIM and DMARC verdicts — the definitive word on whether the mail was authenticated.
Spotting a spoof
If DMARC shows fail, or the Return-Path domain doesn't match the visible From address, be suspicious. Display names are trivial to fake; the authentication results and the routing path are not.
Tracing a message step by step
To follow a message's journey, read the Received lines from the bottom upward — the bottom one is the first server (nearest the sender) and the top is the last before your inbox. Big time gaps between hops point to where a delay happened.
Near the top you'll also find Authentication-Results, which records the SPF, DKIM and DMARC verdicts — the quickest way to tell whether a message is genuinely from who it claims. Rather than parse all this by hand, paste the full headers into our Email Header Analyzer, which lays out the delivery path, each hop's delay, and the authentication results in plain language.
Frequently asked questions
- How do I read email headers?
- Email headers list every server a message passed through plus authentication results. Paste them into our Email Header Analyzer to see the path, hop delays and SPF/DKIM/DMARC verdicts.
- What can email headers tell me?
- They reveal the true sender, the route the message took, timestamps at each hop, and whether it passed authentication — useful for tracing delays or spotting spoofed mail.
- How do I view the full headers of an email?
- In most clients, open the message and look for Show original, View source or View headers. Copy everything and paste it into a header analyzer.
- What is the Received header?
- Each Received line records a server that handled the message, added top to bottom. Reading them from the bottom up traces the path from sender to your inbox.