Email headers are the metadata attached to every message you receive — a record of where the email came from, which servers handled it, and whether it passed authentication checks. They are hidden from the normal message view but accessible through your email client's "view source" or "show original" option. You do not need to understand every line to extract useful information from them.
From, reply-to, and return-path differences
The From address is what you see in your inbox — the name and address displayed as the sender. This field is trivially easy to forge. Anyone can set any From address they choose, which is why a professional-looking From address does not verify that an email is legitimate.
The Reply-To address is where replies are directed. In phishing emails, the Reply-To is often different from the From address. A message might appear to be from your bank's official address, but if you reply, your response goes to an attacker-controlled inbox. This mismatch is a strong signal that the message is not what it appears to be.
The Return-Path (sometimes shown as Envelope-From) is the address that receives delivery failure notifications. Like Reply-To, it is often different from the From address in phishing messages and can reveal the actual sending infrastructure. A Return-Path on a domain completely unrelated to the claimed sender is a red flag.
Authentication results in plain English
Modern email headers include an Authentication-Results section added by the receiving server. This line reports the outcome of SPF, DKIM, and DMARC checks for the message. A legitimate email from a well-configured sender will show results like spf=pass, dkim=pass, and dmarc=pass. A phishing email impersonating a reputable organisation will often show spf=fail or dmarc=fail — because the attacker does not control the real domain's DNS records.
You do not need to parse the raw header text yourself. Most email platforms have a built-in header viewer. In Gmail, click the three-dot menu → Show original. In Microsoft 365 or Outlook, open the message, go to File → Properties, and look for Internet Headers. Google's Messageheader tool (available as a browser extension) parses raw headers into a readable format that highlights authentication failures and routing anomalies.
Why headers should be treated as evidence
If you receive a phishing email impersonating your bank, a government agency, or a business partner, the raw headers are evidence. They can help the real organisation's security team identify the sending infrastructure and take action. They can also help your own IT provider or hosting company investigate whether the issue is part of a targeted campaign against your business.
Do not forward the suspicious email itself to a report address — forwarding strips or modifies headers. Instead, follow the reporting organisation's instructions for submitting raw headers, or use the email platform's built-in reporting function, which usually preserves the original header data.
- View headers in Gmail: three-dot menu → Show original.
- View headers in Outlook: File → Properties → Internet Headers.
- Look for mismatches between From, Reply-To, and Return-Path addresses.
- Check Authentication-Results for SPF, DKIM, and DMARC pass/fail status.
- Use Google's Messageheader tool to parse raw headers into readable form.
- When reporting, preserve raw headers — do not forward the message, which strips metadata.
Headers are not magic, but they can reveal mismatched senders and suspicious routing.
Check a suspicious email