How to Read Email Headers When Something Goes Wrong

When a user reports that an important email never arrived, or a client complains that your email went straight to their junk folder, the first thing any experienced IT professional does is look at the raw email headers. Headers contain the complete technical record of an email's journey — every server it passed through, when, and what authentication checks it passed or failed.

The problem is that raw headers look like an impenetrable wall of technical text. Once you know what to look for, they're actually quite readable. Here's a practical guide to the parts that actually matter.

Where to Find Raw Headers

The method varies by email client. In Outlook desktop, open the email in its own window, go to File, then Properties — the headers are in the Internet headers box at the bottom. Note that this only works when the email is opened in a full window, not the reading pane. In Gmail, open the email, click the three dots in the top-right corner, and select Show original. In Outlook Web (OWA), open the email, click the three dots, then View, then View message details.

The Received Headers — Reading the Journey

The most important headers for delivery troubleshooting are the Received headers. Every server that handles an email adds its own Received header, stamped with the time it was processed. The crucial thing to understand is that these headers are added in reverse order — the most recent one is at the top, and the original one (from the sending server) is at the bottom.

To trace the delivery path, read from the bottom up. Each Received header tells you which server handed the email to which other server, and at what time. By comparing timestamps between consecutive headers, you can see how long the email spent at each hop. A gap of a few seconds is normal. A gap of several minutes usually indicates the email hit a spam filter or greylisting system. A gap of hours suggests something went wrong — a server queue, a timeout, or a filtering hold.

The Authentication-Results Header

This is the header that most IT professionals go to first when investigating deliverability issues. It's added by the receiving mail server and summarises the outcome of the three main email authentication checks.

SPF (Sender Policy Framework) shows whether the sending server's IP address is authorised to send email for the claimed domain. A result of spf=pass means it is. spf=fail means it isn't — a significant red flag. spf=softfail means the domain owner has flagged it as suspicious but hasn't set a hard fail policy.

DKIM (DomainKeys Identified Mail) shows whether the email carries a valid digital signature from the sending domain. dkim=pass means the signature is valid and the email content hasn't been altered in transit. dkim=fail means the signature is invalid or missing.

DMARC shows whether the email satisfies the sending domain's overall authentication policy. dmarc=pass means both the domain alignment and at least one of SPF or DKIM passed. dmarc=fail is the most serious finding — it means the email doesn't meet the sending domain's own stated security policy.

Spotting Phishing Through Headers

Headers are one of the most reliable ways to identify phishing emails, because while attackers can fake the display name and From address that users see, they can't fake the headers added by intermediate and receiving servers. Key things to look for:

• Return-Path mismatch: The Return-Path header shows the actual envelope sender — where bounce messages go. If it doesn't match the From address domain, that's suspicious.
• Reply-To mismatch: If the Reply-To address points to a different domain than the From address, replies will go to the attacker, not the claimed sender.
• Sending IP not matching claimed domain: If an email claims to be from a major bank but the sending IP traces to a residential ISP in another country, something is wrong.
• DKIM fail from claimed domain: A legitimate organisation sending email from their own domain will almost always have DKIM configured. A DKIM fail from a major sender is a serious red flag.

The X-Spam Headers

Many mail servers add X-Spam headers showing the spam score assigned to an email. X-Spam-Score shows the numerical score, and X-Spam-Status shows whether it was classified as spam and what threshold it was measured against. A negative score means the email looks clean. A positive score indicates spam characteristics were detected. If the score exceeds the threshold, the email is typically moved to junk automatically.