Email header fields explained: Received, From, Return-Path and more

The short version

1. Where to find the headers. Every mail app has a way to show the full headers, often called Show original, View source or Message details.
2. The fields people see: From, To, Subject, Date. From, To, Subject and Date are the fields a mail app shows.
3. Received: the route. Every server that handles a message adds a Received line at the top.
4. Return-Path, Reply-To and Message-ID. Return-Path holds the envelope sender, the address bounces are sent to and the address SPF is checked against.
5. Authentication-Results. The receiving server records its SPF, DKIM and DMARC verdicts in an Authentication-Results line, along with the identifiers it checked, such as smtp.mailfrom and header.d.
6. DKIM-Signature. A DKIM-Signature field carries the signing domain in d=, the selector in s=, the signing algorithm in a= and the list of signed fields in h=.

Where to find the headers

Every mail app has a way to show the full headers, often called Show original, View source or Message details. Copy everything from the first line down to the first blank line, because the blank line is where the headers end and the message body begins.

You can paste them into our email header analyzer, which puts the route, the delays and the authentication results in order.

The fields people see: From, To, Subject, Date

From, To, Subject and Date are the fields a mail app shows. They are set by the sender and can say anything, so they are not evidence of where a message came from on their own. A display name can include a different address from the real one, which is a common spoofing trick.

The Date field records when the sender composed the message. Compare it with the times in the Received lines to spot long delays.

Received: the route

Every server that handles a message adds a Received line at the top. Each records which server it received the message from, which server it is, the protocol, and a timestamp. Read them from the bottom up to follow the route in order.

Received: from mail.example.net (mail.example.net [203.0.113.5])
        by mx.example.org with ESMTPS id abc123
        for <you@example.org>; Tue, 13 Oct 2026 16:14:12 +0000

The gap between two timestamps is the time the message spent at a hop. Large gaps usually mean a queue, greylisting or a retry. Lines below the first server you trust may have been written by the sender, so treat them with caution.

Return-Path, Reply-To and Message-ID

Return-Path holds the envelope sender, the address bounces are sent to and the address SPF is checked against. The receiving server adds it. Reply-To says where replies should go, and when it differs from From it deserves a second look. Message-ID is a unique identifier for the message, usually ending in the sending system's domain.

A Message-ID whose domain differs from the From domain is common when a service sends for you, and is not a fault by itself.

Authentication-Results

The receiving server records its SPF, DKIM and DMARC verdicts in an Authentication-Results line, along with the identifiers it checked, such as smtp.mailfrom and header.d. This is the line to read first when mail fails, and it is only trustworthy when it was written by your own receiving server.

Authentication-Results: mx.example.org;
 spf=pass smtp.mailfrom=bounce.example.net;
 dkim=pass header.d=example.net header.s=s1;
 dmarc=fail header.from=example.com

Pass, fail, softfail, neutral, none, temperror and permerror are the usual values. A DMARC fail with SPF and DKIM both passing almost always means the passing domains do not align with From.

DKIM-Signature

A DKIM-Signature field carries the signing domain in d=, the selector in s=, the signing algorithm in a= and the list of signed fields in h=. The receiver uses d= and s= to find the public key in DNS and check the signature.

Check that d= is your own domain and that h= includes From. A signature made with a=rsa-sha1 is old and weak, and the l= tag, which limits how much of the body is signed, lets text be added after signing.

List-Unsubscribe and other useful fields

Marketing mail should carry List-Unsubscribe, and List-Unsubscribe-Post for one-click unsubscribe, which Gmail and Yahoo ask bulk senders to support. Some receivers add spam-filter fields, such as X-Spam-Status, that show how the message was scored.

ARC fields show that a forwarder or mailing list recorded the authentication result it saw, which explains why SPF can fail at the end of a forwarded message.

Further reading and sources

• RFC 5322: Internet Message Format
• RFC 8601: Message Header Field for Indicating Message Authentication Status
• RFC 6376: DomainKeys Identified Mail (DKIM) Signatures
• RFC 5321: Simple Mail Transfer Protocol

Do it in MigoSMTP: help-center articles

• Read email headers to debug authentication
• SMTP bounce codes explained
• Custom return-path and tracking domains

Related guides and tools

• Email header analyzer: Paste headers, get the route and results.
• SPF, DKIM and DMARC checker: Check the live records.
• Fix SPF, DKIM and DMARC failures: Read an error and fix it.
• DMARC policy explained: What alignment means.