How to Read Email Headers
Learn how to find and read the raw headers of an email — trace its delivery path, spot delays, and check whether it's authentic or spoofed.
By the ToolsHub team · Updated May 1, 2026
Every email carries a hidden trail of headers recording each server it passed through. Reading them tells you where a message was delayed, and whether it's genuinely from who it claims. Paste them into our Email Header Analyzer to see it all laid out.
Finding the raw headers
- Gmail — open the message, the ⋮ menu, then "Show original".
- Outlook — File, Properties, and copy the Internet headers box.
- Apple Mail — View, Message, then "All Headers".
What the headers tell you
Received headers are added by each server as the message travels, newest first — read them bottom-up to follow the journey in order. A large time gap between two hops shows where the message sat. The Authentication-Results header holds the receiver's SPF, DKIM and DMARC verdicts — the definitive word on whether the mail was authenticated.
Spotting a spoof
If DMARC shows fail, or the Return-Path domain doesn't match the visible From address, be suspicious. Display names are trivial to fake; the authentication results and the routing path are not.