Reading email headers

Every message carries a header block that records its journey. Reading it answers three questions: where did it really come from, how long did it take, and did the receiver believe it.

Getting the headers

• Gmail: open the message, click the three dots, choose Show original.
• Outlook (desktop): File › Properties › Internet headers.
• Outlook.com: three dots › View › View message source.
• Apple Mail: View › Message › All Headers.

Paste the whole block into the header decoder.

Received lines

Each server that handles a message adds a Received: line at the top, so the bottom line is the first hop and the top line is the last. Each says which host received the message (by), from whom (from, with the connecting address in brackets), how (with ESMTPS means TLS was used) and when. The difference between consecutive timestamps is the delay at that hop; the decoder computes it for you. Large delays at one hop point to a queue, greylisting or a slow spam scan there.

Authentication-Results

Added by the receiving server: spf=pass smtp.mailfrom=…, dkim=pass header.d=…, dmarc=pass header.from=…. This is the receiver's own verdict and the most reliable way to know why a message was treated as it was.

Sender fields

• From is what the recipient sees.
• Return-Path is the envelope sender used for SPF and bounces. Different domains are normal for mailing services.
• Reply-To on a different domain from From is a classic phishing sign.

Originating address

The address in the first (bottom) Received line, or an X-Originating-IP header, identifies the sending client. Look it up on the Reputation facet.