What order should I read email headers in?

Start with the authentication results and the From, Reply-To and Return-Path addresses, then read the Received headers from the bottom up to follow the delivery path, and finish with Date and Message-ID.

Are all email headers equally trustworthy?

No. Headers added by your own receiving provider are the most useful. Lines added earlier in the path, and custom X-* headers, are claims made by other systems and can be invented by a sender.

Where do I find the raw headers?

Look for Show original, View source, Message headers or Internet headers in your mail app. In Gmail it is under the three-dot menu; menu wording differs between apps and versions.

Security

Published October 9, 20263 min read

How to Read Email Headers

A practical, field-by-field guide to reading raw email headers and knowing which lines to trust.

Every email carries a block of metadata above the message body. Mail apps hide it, but it is the first place to look when a message is delayed, lands in spam, or just looks odd. Raw headers look intimidating because they are long and written for machines, yet they follow a small set of rules, and you can learn to read them in a few minutes.

Headers are lines of Name: value

A header is a name, a colon and a value. Long values are folded onto continuation lines that start with a space or tab, and a single header name can appear many times. Received is the best example, because every server adds its own. Header names are not case-sensitive, so From and from are the same header.

From: Example Team <[email protected]>
To: [email protected]
Subject: Your invoice
   is ready
Date: Thu, 8 Oct 2026 12:30:00 +0530
Message-ID: <[email protected]>

In that sample, the Subject is one logical header spread over two lines. The Email Header Analyzer unfolds such lines before analyzing them, which is the first thing to get right when you parse headers yourself.

A sensible reading order

Authentication-Results (and Received-SPF): did the receiving server report SPF, DKIM and DMARC passes?
From, Reply-To, Sender and Return-Path: who does the message claim to be from, and where would replies and bounces go?
Received, from the bottom up: which servers handled the message and when?
Date and Message-ID: when was it created, and which system generated the identifier?
Everything else: X-* headers, List-* headers and MIME headers add context.

The headers that matter most

Header	What it tells you	Trust it as
From	The address shown to the reader	A claim by the sender, checked by DMARC
Return-Path	Where bounces go (envelope sender)	Written by the final receiving server
Reply-To	Where replies will go	A sender-chosen address
Received	One line per server that handled the message	Most reliable for the hops your provider added
Authentication-Results	SPF, DKIM, DMARC outcomes	Reliable only from a system you trust
Message-ID	A unique ID chosen by the sending system	A label, not proof of origin
Date	When the sender's system says it was written	Not authoritative

Read Received headers bottom to top

Each server puts its Received header at the top of the message, so the newest line is first. To follow the path, start at the bottom, which is the first server that took the message, and read upward to your own mailbox provider. See How to Read Received Headers for a worked example.

What headers cannot tell you

Headers can show which domains authenticated and which servers were involved. They cannot prove who the human sender is, where they were, or whether the message is safe. Email headers can provide useful authentication and routing information, but they cannot by themselves prove that a message is safe or malicious. Treat them as evidence to weigh together with the message content and context.

Let the tool do the parsing

Paste the headers into the Email Header Analyzer to see the authentication results, delivery path, timestamps and anomalies laid out in one place. Processing happens in your browser.

Share headers safely

Headers contain addresses, IP addresses and server names. If you need to paste them into a ticket or chat, mask the sensitive values first with the Log Sanitizer, and only analyze messages you are authorized to inspect.

Frequently asked questions

What order should I read email headers in?: Start with the authentication results and the From, Reply-To and Return-Path addresses, then read the Received headers from the bottom up to follow the delivery path, and finish with Date and Message-ID.
Are all email headers equally trustworthy?: No. Headers added by your own receiving provider are the most useful. Lines added earlier in the path, and custom X-* headers, are claims made by other systems and can be invented by a sender.
Where do I find the raw headers?: Look for Show original, View source, Message headers or Internet headers in your mail app. In Gmail it is under the three-dot menu; menu wording differs between apps and versions.