What Are Email Headers?
The Fields at the Top of Every Message
Email headers are the lines of data placed before the body of every message. They are normally hidden in a mail program, but most clients and webmail services can show the full or original headers. Each line is a field with a name and a value, such as From, Subject or Date. Some fields are written by the sender's software, while others are added by mail servers as the message passes through them. The route a message takes is described in how email works.
The fields most people know are From, To, Cc, Subject and Date. Reply-To sets the address that replies should go to, which can differ from the From address. Message-ID gives each message a unique identifier, and mail programs use it to group replies into conversations.
Routing and Authentication Fields
Some fields show how a message traveled. Return-Path records the address that bounces should go to, and the receiving server sets it from the envelope sender when delivering. Each server that handles the message adds a Received line at the top of the header block. Because new lines go on top, reading from the bottom upward shows the order in which servers handled the message.
Received lines are useful clues but not proof. A sender can insert fake lines, and some servers record details incorrectly. The most reliable lines are those added by servers you trust, such as your own provider's. The Authentication-Results field is added by the receiving server and summarizes the outcome of checks such as SPF, DKIM and DMARC. Its value is only as trustworthy as the server that wrote it.
Spotting a Mismatch in a Suspicious Invoice
A customer forwards an invoice that appears to come from a known supplier. The From line shows the supplier's name, but the Return-Path points to a different domain, and the Authentication-Results field records a failed DKIM check. These mismatches suggest the sender name was faked. Headers can reveal evidence of this kind, but a single field should never be read alone. For more on forged senders, see email spoofing.
Frequently asked questions
Can email headers be faked?
Yes. The From, Date and Subject fields are written by the sender's software and can be set to anything. Received lines and Authentication-Results carry more weight, because servers add them, but they still depend on those servers being honest. Checks such as SPF, DKIM and DMARC together are a more reliable way to confirm a sender.
Where can I see the full headers of an email?
Most mail programs and webmail services have an option to show the original or full headers, usually in the message menu. The wording varies between programs. The header text is plain, so you can read it as it is or paste it into a header analysis tool.