Email 3 min read

Every email carries a block of headers: technical lines added by the sender's program and by every server that handled the message. They show where the email really came from, how long it took and whether the sender's domain vouched for it. Paste headers into our Email Header Analyzer to read them automatically.

How to see the headers

Mail app Steps
Gmail Open the message → ⋮ → Show original
Outlook.com Open the message → … → View → View message source
Outlook desktop Open the message → File → Properties → Internet headers
Apple Mail View → Message → Raw Source
Yahoo Mail … → View raw message
Thunderbird View → Message Source

The headers that matter

Header What it shows
From The sender shown to you. Easy to fake.
Return-Path Where bounces go: the envelope sender used for SPF
Reply-To Where your reply goes, if different from From
Received One line per server that handled the message
Authentication-Results The receiving server's SPF, DKIM and DMARC verdicts
DKIM-Signature The sender's cryptographic signature
Message-ID A unique ID, usually containing the sending domain
X-Originating-IP Sometimes, the sender's own IP address

Reading the Received lines

Each server adds its Received line on top, so the list reads from newest (top) to oldest (bottom). To follow the message's journey, read from the bottom up:

Received: from mail.example.org (mail.example.org [203.0.113.25])
        by mx.recipient.net with ESMTPS; Mon, 19 Oct 2026 16:15:20 +0000

This line says: the server mx.recipient.net received the message from a server calling itself mail.example.org, whose real IP was 203.0.113.25, at 16:15:20 UTC. The name after "from" is what the sender claims; the IP in brackets is what the receiving server actually saw, and it cannot be faked by the sender.

The bottom-most line with a public IP is usually the origin. Look it up with our IP Lookup to see the network and country.

Spotting phishing

Warning signs:

  • Authentication-Results shows spf=fail, dkim=fail or dmarc=fail.
  • The From domain differs from the Return-Path and DKIM d= domain, for example a "bank" email sent through an unrelated domain.
  • Reply-To points to a free webmail address.
  • The origin IP belongs to a home connection or a country that does not match the company.
  • The sending IP is on a spam blacklist.

None of these alone proves phishing, but several together are a strong sign. When in doubt, do not click links; contact the company through its official website.

Limits of tracing

  • Webmail hides the sender's IP. Gmail and Outlook.com show only their own servers, so the trace ends at the provider.
  • Lines below the first trusted server can be forged by a spammer who adds fake Received lines.
  • Clocks differ between servers, so delays can look odd.

Frequently asked questions

Can I find the sender's home address from an email?

No. At most you find the IP and network of the sending server or connection.

Are email headers private?

They contain email addresses and server names. Do not post them publicly; remove addresses before sharing.

What should I do with a phishing email?

Report it with your mail app's "Report phishing" button, then delete it.