Glossary
What Are Email Headers?
Email headers are the structured metadata at the top of every message — who it's from and to, when it was sent, the servers it passed through, and how it fared in authentication checks. Your mail app shows four or five of them; the full set on a typical message runs to dozens, all sitting in the raw message as one Name: value line per field (the shape defined by RFC 822 in 1982).
The headers worth knowing
| Header | What it tells you |
|---|---|
From / Reply-To | The claimed author — and where replies actually go. A mismatch is a classic scam tell. |
Return-Path | The envelope sender, where bounces go — can legitimately differ from From. |
Received | One line per server hop, newest at the top. Read bottom-up to trace the route. |
Message-ID | A globally unique ID for the message — threading and dedupe key on it. |
Date | The sender's clock — not necessarily accurate. |
Authentication-Results | The receiving server's SPF, DKIM, and DMARC verdicts. |
How to see the full headers
- Gmail: open the message → ⋮ menu → Show original
- Outlook: View message source (web) or File → Properties → Internet headers (desktop)
- Apple Mail: View → Message → All Headers
Or skip the squinting: paste them into our free email header analyzer, which reconstructs the delivery path with per-hop delays and explains the SPF, DKIM, and DMARC verdicts in plain language. If you have the message as a file, the EML viewer's Headers tab lists every field.
Can headers be trusted?
Partially — and knowing which part is the whole game. A sender can type anything into From, Reply-To, Subject, or Date; that's why phishing works. What's hard to fake is the receiving side: each Received line is stamped by the server that handled the message, and Authentication-Results records whether the sending domain actually proved itself (check a domain's own posture with our SPF, DKIM, and DMARC checkers). It's also why a screenshot of an email proves nothing, while a saved .eml file with intact headers is real evidence.
FAQ
How do I view full email headers?
In Gmail, open the message and choose "Show original" from the ⋮ menu. In Outlook, use "View message source" on the web or File → Properties → Internet headers on desktop. In Apple Mail, View → Message → All Headers. Every client has some variant — the raw message always carries the full set.
Can email headers be faked?
The author-written ones can: From, Reply-To, Subject, and Date are just text the sender chose. The Received chain added by each relaying server and the receiving server's Authentication-Results (SPF, DKIM, DMARC) are far harder to forge — which is why header analysis focuses there.
What is a Message-ID header?
A globally unique identifier the sending system assigns to each message, like [email protected]. Threading, duplicate detection, and archiving key on it — InboxBucket dedupes on Message-ID so a retried delivery is never stored twice.
Do email headers reveal my location?
Sometimes. Some clients and providers embed the submitting IP address in the first Received line, though the big webmail providers no longer expose your home IP for mail sent through their web interfaces. The reliable way to know what your setup leaks is to email yourself and read the headers.