How to Read and Understand Email Headers

Every email carries a hidden section called the header — a behind-the-scenes log of where the message came from, the servers it passed through, and the checks it passed or failed on the way. When you are trying to work out why a message is late, or whether it is genuine, the header holds the answers.

How to view the full header

The steps differ slightly by mail app, but the idea is the same:

• cPanel Webmail (Roundcube) — open the message, click More → Show source.
• Gmail — open the message, click the three dots, choose Show original.
• Outlook — open the message, then File → Properties and read the Internet headers box.

New to webmail? See logging in to cPanel Webmail.

The lines that matter most

• From — the claimed sender. Easy to fake, so never trust it alone.
• Received — a stack of hops, read from bottom to top. The bottom-most shows where the message really started.
• Return-Path — where bounces go; often reveals the true sender.
• SPF, DKIM, DMARC results — pass or fail marks showing whether the sender was authorised. A string of "fail" here is a strong spam or spoofing signal.

Using headers to spot a fake

If an email claims to be from your bank but the Received chain starts at an unrelated server, and SPF or DKIM fail, treat it as suspicious. Our guide on staying safe online and spotting phishing pairs well with this.

Using headers to debug delivery

Delays show up as long gaps between Received timestamps. If your own outgoing mail keeps failing checks, the fix is usually to set up authentication — see adding SPF, DKIM and DMARC records.

Frequently asked questions

Why do I read Received lines from the bottom up?

Each server adds its line to the top as the message passes through. So the oldest hop — the true origin — sits at the bottom, and the most recent (your own server) sits at the top.

Can headers be completely faked?

The From line can be forged easily, but the Received lines added by real mail servers are much harder to fake, and SPF/DKIM checks are designed to catch spoofing. That is why they are so useful.

My legitimate emails are failing SPF. What do I do?

That usually means your sending domain is not authorising the server you send from. Fix it by setting up proper SPF, DKIM and DMARC records, then test again.