An email header is a block of metadata prepended to every email message. It is not usually visible in a normal mail client, but it records the full routing path the message took, timestamps at each hop, and the results of sender authentication checks.
Common header fields
- From — the address the sender claims to be sending from. This can be spoofed.
- To / CC / BCC — recipients. BCC is stripped before delivery.
- Subject — the message subject line.
- Date — timestamp set by the sending client.
- Message-ID — a globally unique identifier for this message.
- Received — one entry added by each mail server in the delivery chain, in reverse chronological order (newest at top).
- Return-Path — the envelope sender, used for bounces.
- DKIM-Signature — a cryptographic signature proving the message body was not modified in transit.
- Authentication-Results — the receiving server's verdict on SPF, DKIM and DMARC.
Reading the Received chain
Each Received: header shows which server handed the message to which server and when. Reading from bottom to top gives you the path from sender to your inbox. Large delays between hops can indicate greylisting, spam queues or server overload.
What headers reveal
Headers can reveal the sender's mail server IP address, the mail client they used, and the path the message took. This is one reason to block remote images in email: open-tracking pixels fire an HTTP request that logs your IP and timestamp, even though none of that information appears in the visible message.