What is an email header?

An email header is the block of technical lines at the top of every email, above the message body. It records who sent the message, who it’s for, the date, and every server that handled it on the way. Mail apps show only a few of these lines, such as From, To and Subject, and hide the rest.

Also called: email headers, message header, internet headers, full headers

Updated October 2026. Sources are numbered and listed at the end.

On this page

How an email header works

An email is a text file in two parts: a header, then a blank line, then the body. The header is a list of fields, each a name, a colon and a value. Only two are required, the date and the From address.1 The rest are added along the way, by three different parties:

  • The sender’s mail app writes From, To, Subject, Date and a unique Message-ID.
  • Every server that handles the message adds a Received line at the top, with its name and the time.2
  • Your own provider adds the results of its checks when the message arrives, on the Authentication-Results line.3

The header fields worth knowing

Common header fields and what each one tells you.
FieldWhat it tells you
FromThe address the sender wants you to see. The sender writes it
Reply-ToWhere your reply goes, if different from From
Return-PathWhere bounces go. This is the address SPF checks
ReceivedOne line per server, newest on top. Read from the bottom up to follow the route
Authentication-ResultsYour provider’s SPF, DKIM and DMARC verdicts
DKIM-SignatureThe sending domain’s digital signature
Message-IDA unique ID for the message, used to thread replies

Why email headers matter

The parts of an email you normally see are the parts the sender controls. The From name, the address and the subject can say anything. The header holds the parts the sender doesn’t fully control: the route recorded by each server and the authentication results written by your own provider. That makes it the place to look when you need to know whether a message is genuine, why it arrived late, or whether it was encrypted between servers.

Headers matter for privacy too. They are metadata: they travel with every message, and they can include the IP address of the device a message was written on and the name of the mail app that sent it.

How to read an email header

  1. Open the full header. In Gmail, open the email, click the three dots next to Reply and choose Show original. Other mail apps have a similar option, often called View source or View raw message.
  2. Find Authentication-Results. Look for spf=, dkim= and dmarc=. A DMARC pass means the From domain is backed by SPF or DKIM.
  3. Compare From, Reply-To and Return-Path. A Reply-To on an unrelated domain is a common phishing trick.
  4. Follow the Received lines from the bottom up. The route should start at servers that belong to the company in the From line.

Where you’ll see email headers

You’ll be asked for “full headers” when you report phishing, when a support team investigates a missing or delayed message, and when you want to check a suspicious email yourself.

Email header analyzerFree tool: paste an email’s headers to see its route and its SPF, DKIM and DMARC results. SPFThe DNS record that lists which servers may send email for a domain. DKIMA digital signature on every email that shows which domain sent it. DMARCThe policy that tells receivers what to do with email that fails SPF and DKIM. MetadataThe data about your data: who, when and where, and what it reveals on its own. Tracking pixelThe invisible image that tells a sender when, where and how often you opened an email.

Sources

  1. IETF, RFC 5322: Internet Message Format (October 2008).
  2. IETF, RFC 5321: Simple Mail Transfer Protocol (October 2008). Section 4.4 covers Received lines.
  3. IETF, RFC 8601: Message Header Field for Indicating Message Authentication Status (May 2019).

Checked October 2026.

Questions about email headers

Can email headers be faked?

Partly. The sender writes From, Reply-To, Subject and Date, and can add made-up Received lines at the bottom. The Received lines and the Authentication-Results line added by your own provider are the ones you can rely on.

Do email headers show the sender’s IP address?

Sometimes. Large webmail services usually leave out the IP address of the person who wrote the message. Other providers and some desktop setups include it in an X-Originating-IP header or in the earliest Received line.

How do I see the full header of an email?

In Gmail, open the message, click the three dots next to Reply and choose Show original. In Outlook on the web, click the three dots, then View and View message source. In Apple Mail on a Mac, choose View, Message, Raw Source.

What is the difference between the header and the body of an email?

The body is the message you read. The header is the block of fields above it that says where the message came from, where it is going and how it got there. A blank line separates the two.

Email that’s ready for what comes next.

Post-quantum encryption on every plan, free included.

Start free

Explore Secria Mail