Every email carries a block of hidden lines before the visible message, called the headers. They record who sent the message, which servers handled it, when each step happened and whether it passed security checks. If you want to trace a suspicious email, find out why a message went to spam or work out why delivery was slow, the headers are where the evidence is. This guide explains what email headers are, how to view them in Gmail, Outlook and other mail apps, how to read the most important fields and how to analyse them to check authentication and spot forgery.
What are email headers?
An email has two parts: the headers and the body. The body is what you read. The headers are lines of the form Name: value that sit above it. Some, like Subject, To and Date, are shown by your mail app. Many more are hidden, and they are added by the servers that handle the message. The format is defined in the internet message standard, RFC 5322.
Headers matter for three reasons. They help you check whether a message is genuine. They help senders debug delivery. And they help support teams trace a message that was lost or delayed. Our guide to tracing a message through logs and events covers the sender's side of the same story.
How to view email headers
Menu names differ between versions and change over time, so look for the option called "Show original", "View message source", "Message details" or "Internet headers".
Gmail
- Open the message.
- Click the three-dot menu at the top right of the message.
- Choose Show original.
- A new tab opens with a summary at the top, including the results of SPF, DKIM and DMARC, and the full raw headers below. There is a button to copy them.
Outlook (desktop)
- Double-click the message to open it in its own window.
- Go to File, then Properties.
- The headers appear in the Internet headers box at the bottom. Copy them into a text editor to read them.
Outlook on the web and the new Outlook
Open the message, use the more-actions menu (three dots), and look for View and then View message details or a similar entry. The headers open in a dialog you can copy from.
Apple Mail
Select the message, then in the menu bar choose View, then Message, then All Headers, or Raw Source to see the whole message.
Yahoo Mail and others
Open the message, use the more-actions menu and choose View raw message or View headers. Almost every mail service has an equivalent.
If you are looking at headers for a suspicious message, do not click anything in the message itself. View the source, copy the headers and read them as text.
An example of email headers
This shortened sample shows the shape. Values are made up.
Return-Path: <[email protected]> Received: from mail.example.com (mail.example.com [203.0.113.10]) by mx.recipient.example with ESMTPS id abc123 for <[email protected]>; Tue, 13 Oct 2026 09:14:02 +0000 Authentication-Results: mx.recipient.example; spf=pass smtp.mailfrom=mail.example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com From: "Example Shop" <[email protected]> To: [email protected] Subject: Your order Date: Tue, 13 Oct 2026 09:14:00 +0000 Message-ID: <[email protected]> MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8
The headers that matter most
- From. The sender that you see. It is easy to forge, which is why the checks below matter.
- Return-Path. Also called the envelope sender or MAIL FROM. It is where bounces go, and it is the address that SPF checks. It can differ from From, and for mail sent through a service it often does. See what the via label in Gmail means.
- Received. Each server adds one line at the top as it handles the message, so the lines read in reverse order. The lowest one is the first server. Read from the bottom up to follow the path.
- Authentication-Results. Added by the receiving server. It reports SPF, DKIM and DMARC as pass, fail, neutral or none.
- DKIM-Signature. The signature added by the sender, with the signing domain (
d=) and selector (s=). - Message-ID. A unique identifier for the message. Support teams use it to find the message in logs.
- Date. When the sender created the message. Compare it with the times in the Received lines to find delays.
- Reply-To. Where replies go, if it differs from From. A mismatch is common in phishing, but also in legitimate newsletters.
- List-Unsubscribe. Present on legitimate bulk mail, as in our one-click unsubscribe guide.
- MIME-Version and Content-Type. Describe the structure of the body. See MIME and multipart messages.
- X- headers. Custom fields added by services, such as spam scores or tracking IDs. Their meaning depends on who added them.
How to analyse email headers step by step
- Copy the full headers into a plain text editor.
- Find Authentication-Results. Note SPF, DKIM and DMARC. Three passes that align with the From domain are a good sign. A fail on DMARC for a message that claims to be from a bank is a red flag.
- Compare From, Return-Path and DKIM d=. They should share a domain, or an organisational domain, for DMARC to align.
- Read the Received lines from the bottom. The first line shows where the message entered the mail system. A message that claims to come from a large company but first appears from an unrelated server is suspicious.
- Check the times. A gap of many minutes or hours between two Received lines shows where the delay happened.
- Look for mismatches. A display name that says one company while the address belongs to another, a Reply-To to a free mailbox, or a link domain that differs from the sender.
Can email headers be faked?
Yes, partly. The sender controls the From line, Subject and many other fields, and can also write false Received lines at the bottom of the chain. What a sender cannot easily fake are the lines added by the receiving server at the top, such as Authentication-Results, because your provider writes them. This is why you read the top of the headers for the verdict and the bottom for the claimed path, and why you trust the lines added by your own provider more than anything below them.
Using headers to debug your own sending
If you send email, send a test to a Gmail and an Outlook address and view the headers. Check that SPF and DKIM pass and that the signing domain is yours. If you see a fail, our guides on authenticating your domain and SPF lookup errors explain the fixes, and the free SPF, DKIM and DMARC checker shows what your domain publishes. You can also add your own custom headers to a message, for example to carry a campaign ID that you can see later in events and webhooks. See email webhooks and delivery events for how to use identifiers like these.
Privacy note
Headers can contain IP addresses, server names and internal identifiers. Before you paste headers into a forum or a ticket, remove your own email address and any details you want to keep private. Never share a header that includes authentication tokens or unsubscribe links tied to your account.
See what happened to every message you send Message logs and events show each step from accepted to delivered, with the server replies.
References and further reading
Frequently asked questions
What are email headers?
They are hidden lines at the top of an email that record the sender, the servers that handled it, the times and the results of security checks.
How do I view email headers in Gmail?
Open the message, click the three-dot menu and choose Show original. The page shows SPF, DKIM and DMARC results and the raw headers.
How do I view email headers in Outlook?
In desktop Outlook open the message in its own window and choose File, then Properties, and read the Internet headers box. On the web, look for View message details in the more-actions menu.
How do I read the Received lines?
Each server adds one at the top, so read from the bottom up. The lowest line is where the message first entered the mail system.
Can email headers be faked?
The sender can forge the From line and the lower Received lines. Lines added by your own provider, such as Authentication-Results, are more reliable.