How to View Email Headers
Open the message in your email client and use its original-source or message-details view to see the full header. Copy the whole header block, including folded continuation lines, if you want to paste it into an analyzer.
View Email Headers in Gmail
In Gmail on the web, open the message, click the three-dot More menu next to Reply and choose Show original. The page shows the full header with an SPF, DKIM and DMARC summary at the top. Use Copy to clipboard or Download original to save it.
View Email Headers in Outlook
In the new Outlook and Outlook on the web, open the message, choose More actions, then View and View message details. In classic Outlook for Windows, open the message, choose File and then Properties, and read the Internet headers box. Select all the text in that box before copying, because it scrolls.
Email Header Fields Explained
The fields that matter most are From, Return-Path, Reply-To, Received, Authentication-Results, DKIM-Signature and Message-ID. The table below explains what each one describes and where its limits are.
Email Header vs Envelope
The From header is what the reader sees, while the envelope sender is the address given during the SMTP transaction and recorded as Return-Path. The two often differ legitimately, for example when a newsletter service handles bounces. A Reply-To that points to an unrelated domain deserves a closer look.
| Header | What it describes | Important limit |
|---|---|---|
| From | Displayed author | Can be forged |
| Return-Path | Envelope return address | May legitimately differ |
| Received | Visible delivery hop | Earlier lines can be untrusted |
| Authentication-Results | Receiver authentication findings | Must come from a trusted receiver |
| DKIM-Signature | Signature parameters | Requires cryptographic verification |
| Message-ID | Unique message identifier | Set by the sender and can be invented |
Read the Received Header Chain
Each server that handles a message adds a Received line at the top, so read the chain from the bottom up to follow the route. Only the lines added by servers you trust, usually your own provider’s, are reliable evidence.
Find the Originating IP Address
The earliest Received line added by a trusted server shows the IP address that connected to it. That address usually belongs to a mail provider or relay rather than the sender’s device, so it does not reveal a person’s location. Lines below it were written by servers you cannot verify and may be forged.
Check SPF, DKIM and DMARC in the Header
Find the Authentication-Results header added by your receiving provider, which records the SPF, DKIM and DMARC results it calculated. Trust only the copy added by your own provider, because a sender can insert a fake one.
Check Email Headers for Spoofing
Compare the From domain with the domains that passed SPF and DKIM, and confirm that DMARC passed. A spoofed message often shows dmarc=fail, an unrelated Return-Path or a Reply-To that sends answers elsewhere. A pass still does not prove a message is safe, because attackers can authenticate their own look-alike domains.
Read the DKIM-Signature Header
In DKIM-Signature, d= names the signing domain and s= names the selector that publishes the key. Look up that pair in the DKIM Checker to confirm the public key exists. A key lookup alone cannot verify the signature over the message content.
Frequently Asked Questions
What Is an Email Header?
An email header is the block of fields above the message body that records the sender, recipients, subject, date and the route the message took. Mail servers add fields such as Received and Authentication-Results while the message travels. Most email clients hide it unless you open the original source.
Can Email Headers Be Spoofed?
Yes. The sender controls fields such as From, Reply-To and Date, and any Received lines added before the message reaches a trusted server. Only fields added by your own provider, such as its Received and Authentication-Results lines, are reliable.
Do Email Headers Contain an IP Address?
Usually, yes. Received lines record the IP addresses of the servers that passed the message along, and some providers also record the client’s address. Many large webmail services omit the user’s own IP address, so the earliest address is often a provider server.
Are Email Headers Encrypted?
Not end to end. TLS can protect the whole message, headers included, while it moves between servers, but each server can still read it. S/MIME and OpenPGP usually encrypt only the body, so fields such as From, To and Subject stay readable.