How to read email headers and trace a message's path

Email headers are the hidden "envelope history" of a message: every server it passed through, when, and what checks it passed. Reading them is the fastest way to find out why mail went to spam, arrived late, or looks forged. This guide shows how to read email headers step by step.

Before you start

Open the full headers (also called "original message" or "message source"):

• Gmail: open the message → three-dot menu → Show original.
• Outlook (desktop): open the message → File → Properties → Internet headers.
• Roundcube (cPanel webmail): open the message → More → View source.
• Thunderbird: View → Message Source.

Read Received lines from the bottom up

Each server adds a Received: line at the top, so the oldest hop is at the bottom.

Received: from mail.example.com (mail.example.com [203.0.113.60])
        by mx.recipient.example with ESMTPS id abc123
        for <bob@recipient.example>; Tue, 14 May 2026 10:02:15 +0000
Received: from [192.168.1.20] (unknown [198.51.100.7])
        by mail.example.com with ESMTPSA id xyz789;
        Tue, 14 May 2026 10:02:13 +0000

• from – who handed over the message (name the sender claimed plus the real IP in brackets).
• by – the server that received it.
• with ESMTPS / ESMTPSA – S means TLS was used; A means the sender authenticated.
• Timestamp – compare consecutive hops to find where a delay happened.

Authentication-Results

Authentication-Results: mx.recipient.example;
  spf=pass smtp.mailfrom=example.com;
  dkim=pass header.d=example.com header.s=default;
  dmarc=pass header.from=example.com

Spam filter headers

• X-Spam-Status: Yes, score=7.2 required=5.0 tests=... – SpamAssassin's score and the rules that fired.
• X-Spamd-Bar / X-Spam-Level – Rspamd or SpamAssassin score as a bar of symbols.
• Provider-specific headers (such as Microsoft's X-Forefront-Antispam-Report with an SCL value) show their own verdicts.

Spot forged mail

1. Compare the visible From: with Return-Path: and the DKIM header.d domain.
2. Check the bottom-most Received line's IP: does it belong to the claimed sender's mail provider?
3. Look for dmarc=fail.
4. Watch for a Reply-To: pointing to a different domain – common in phishing.

Diagnose common problems

• Went to spam: check SPF/DKIM/DMARC results and the spam score rules.
• Arrived late: find the hop with the big time gap; it's usually greylisting or a queue on that server.
• Message altered: DKIM fails after a mailing list or forwarder changes the body or subject.

FAQ: reading email headers

Can headers be faked?

Senders can forge headers added before their message leaves them, but Received lines added by servers you trust (your own provider) are reliable.

Is it safe to share headers with support?

Yes, generally – they contain addresses and IPs but not passwords. Remove anything you consider private.

Why are there so many Received lines?

Large providers pass mail through several internal servers for filtering and routing.

Next steps

• SPF, DKIM and DMARC explained
• Fix emails going to spam
• SMTP reply codes explained