Email header fields explained
Every email carries a block of headers above the message you read. This dictionary explains the fields you'll actually see, what each one proves, and which ones a sender can fake.
Quick answer
Headers are lines such as From:, Received: and Message-ID: at the top of every email. The sender writes most of them, so they can be faked. The Received lines added by your own provider and the Authentication-Results line are the ones you can trust. Paste a full header into the header analyzer to read it automatically.
Who writes which headers
Headers come from three places, and that decides how far you can trust them:
- The sender's app writes From, To, Subject, Date, Message-ID and Reply-To. Anyone can put anything here.
- Each mail server on the way adds a Received line at the top. Only the ones added by your own provider are reliable.
- Your provider adds Authentication-Results, Return-Path and its spam verdict when the message arrives.
Addresses and identity
| Field | What it means |
|---|---|
From | The sender you see in your inbox. Easy to fake; DMARC is what checks it. |
Sender | Who actually sent it, when different from From, such as an assistant or a mailing list. |
Reply-To | Where replies go. A Reply-To on a different domain from From is a common phishing sign. |
Return-Path | Where bounces go (the "envelope sender"). Added by the receiving server from the SMTP MAIL FROM command. SPF checks this domain. |
To, Cc | The visible recipients. Bcc recipients never appear in the copy others receive. |
Delivered-To | The mailbox the message was finally delivered to. Useful when mail arrives through an alias or forward. |
Routing and timing
| Field | What it means |
|---|---|
Received | One line per server hop, newest at the top. Each says which server handed the message to which, and when. Read from the bottom up to follow the route. |
Date | When the sender's app says it was written. Set by the sender, so it can be wrong. |
X-Originating-IP | Added by some webmail services: the IP address of the person who sent it. Many providers no longer include it. |
Big gaps between the times on two Received lines show where a message was delayed.
Threading
| Field | What it means |
|---|---|
Message-ID | A unique ID for this message, such as <[email protected]>. The part after the @ usually shows which system created it. |
In-Reply-To | The Message-ID of the email this one answers. |
References | The Message-IDs of the whole conversation. Mail apps use it to group messages into threads. |
Authentication and spam
| Field | What it means |
|---|---|
Authentication-Results | Your provider's verdict on SPF, DKIM and DMARC: pass, fail, softfail or none. The most useful single line for spotting fakes. |
DKIM-Signature | The sender's digital signature. d= is the signing domain and s= the selector. |
ARC-Seal, ARC-Authentication-Results | Added by forwarders and mailing lists to record the authentication results before they changed the message. See how forwarding breaks SPF and DMARC. |
Received-SPF | An older way some servers record the SPF result. |
X-Spam-Status, X-MS-Exchange-Organization-SCL | Spam filter scores. Microsoft's SCL runs from -1 (trusted) to 9 (spam); 5 or more usually means junk. |
Mailing lists and content
| Field | What it means |
|---|---|
List-Unsubscribe | A link or address for unsubscribing. Gmail and Yahoo show an Unsubscribe button from it. |
List-Unsubscribe-Post | Set to List-Unsubscribe=One-Click to allow one-click unsubscribe, which Gmail and Yahoo require from bulk senders. |
List-Id | Identifies the mailing list, so you can filter on it. |
Precedence: bulk | Marks mass mail; tells auto-responders not to reply. |
Auto-Submitted | Marks automatic messages such as out-of-office replies, so other robots don't answer them. |
MIME-Version, Content-Type | How the body is built: plain text, HTML, attachments. See email encoding explained. |
Questions people ask
- Which email header shows the real sender?
- No single field proves it. Check Authentication-Results for DMARC pass, and the oldest Received lines added by your own provider.
- Can email headers be faked?
- Yes, anything the sender's app writes can be faked, including From and Date. The Received lines added by your provider and its Authentication-Results can't be faked by the sender.
- How do I see the headers?
- In Gmail, open the message, click the three dots and choose "Show original". In Outlook, open the message and choose View › View message details (or File › Properties in the desktop app).
Sending one email to a whole list? Check the addresses first with Veml, which removes bad and risky emails before you hit send. (Veml and EmailNa have the same owner.)