Uncategorized

How to Read an Email Header (with Real Examples)

By MailChannels | 5 minute read

Email headers are the unsung heroes of email troubleshooting. While the content of an email tells the user what was said, the header reveals how it got there. If you’re trying to figure out why an email was delayed, ended up in spam, or failed to authenticate, start with the header.

In this blog, we’ll break down the key components of an email header, explain what each part means, and walk through a real-world example so you can confidently analyze your own headers.

What Is an Email Header?

An email header is a block of metadata that travels with every email message. It contains information about:

The sender and recipient
The sending and receiving servers
Timestamps of each step in transit
Authentication results (SPF, DKIM, DMARC)
Message ID and subject

Headers are not usually visible to the average email recipient—but they’re essential for diagnosing delivery problems.

Why Email Headers Matter

Email headers allow you to:

Trace the path of an email: See which servers handled it and how long each hop took
Verify authentication: Check if SPF, DKIM, and DMARC passed or failed
Debug spam issues: Look for clues like high spam scores or failed lookups
Match user-reported problems to real delivery behavior

If you work in email ops, support, or development, knowing how to read a header is a must.

How to View an Email Header

Each email client has a way to reveal full headers:

Gmail: Click the 3 dots (More) > Show original
Outlook: File > Properties > Internet headers
Apple Mail: View > Message > All Headers
Thunderbird: View > Headers > All

Once you’ve found it, you’ll see a dense wall of text. Don’t panic, you’re looking for specific fields.

Key Fields in an Email Header (What to Look For)

Here’s a breakdown of the most useful fields:

1. Received

Tracks each mail server that handled the message. The topmost “Received” is the most recent hop.

Example:

Received: from mail.example.com (mail.example.com. [203.0.113.1])

        by mx.google.com with ESMTPS id x22si12345678qka.33.2025.07.21.10.03.20

        for <user@gmail.com>;

        Mon, 21 Jul 2025 10:03:21 -0700 (PDT)

2. From / To / Subject / Date

Basic envelope information. Be sure the “From” matches the expected domain, especially for phishing checks.

3. Message-ID

A unique identifier assigned by the sending server. Useful for correlating logs.

4. Authentication-Results

Shows the results of SPF, DKIM, and DMARC validation.

Example:

Authentication-Results: mx.google.com;

dkim=pass header.i=@yourdomain.com;

spf=pass (google.com: domain of info@yourdomain.com designates 203.0.113.1 as permitted sender);

dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=yourdomain.com

5. Return-Path

Indicates the actual sender of the email, important for bounce processing.

6. X-Headers

Custom or diagnostic headers added by ESPs, spam filters, or SMTP relays. These often include:

Spam scores
Authentication info
Envelope sending IP and domain
Relay-specific metadata (e.g., X-MailChannels-Client)

Real Example: Diagnosing a Delayed Email

Let’s say a user reports they received a password reset email 15 minutes late. You pull the header and find this:

Received: from app.mailplatform.net (192.0.2.5)

        by mx.google.com with ESMTPS id h23si4567890qkf.9.2025.07.21.09.18.12;

        Mon, 21 Jul 2025 09:18:13 -0700 (PDT)

Received: from internal-api (localhost [127.0.0.1])

        by app.mailplatform.net with ESMTP id 3DK2123ABC

        for <user@gmail.com>; Mon, 21 Jul 2025 09:03:07 -0700 (PDT)

Diagnosis:

The email was sent from your app at 09:03
It reached Gmail at 09:18
That’s a 15-minute delay between sending and delivery

Now you can investigate your SMTP relay or queue behavior between those two timestamps.

Best Practices When Reading Headers

Read from bottom to top: The bottom “Received” header is the first server.
Use header parsing tools: Try Google Admin Toolbox to speed up analysis.
Correlate Message-ID in logs: Helps match header data to server events.
Check IPs and domains: Make sure the email is coming from trusted infrastructure.
Watch for soft/hard fail auth results: These often correlate with spam folder placement.

Tools That Help Analyze Headers

Google Admin Toolbox Messageheader
MxToolbox Header Analyzer
Your ESP or SMTP provider’s logs/dashboard

Learn More

Want to go deeper into troubleshooting and debugging email delivery?

Explore these related resources:

Final Thoughts

Reading an email header is like reading the fingerprint of a message’s journey. Once you get the hang of it, you can spot issues before they become user complaints, and resolve problems faster when they do arise.

Need smarter tools to track and troubleshoot email performance?
Explore MailChannels Transactional Email for built-in diagnostics and reliable delivery infrastructure.