How to read email headers like a deliverability pro

Every email carries a hidden flight recorder: the full headers. They reveal the SPF, DKIM and DMARC verdicts, who really sent the message, and every server it passed through. Once you can read them, spam-folder mysteries stop being mysteries.

How do I see full email headers?

Email clients hide headers by default — you only see From, To, Subject and Date. To see the rest:

• Gmail: open the message, click the three-dot menu, then Show original. Copy the full text from the new window.
• Outlook (web): open the message, click the three-dot menu, then View → View message details.
• Outlook (desktop): double-click the message to open it, then File → Properties → Internet headers.
• Apple Mail: select the message, then View → Message → All Headers (or Raw Source for the complete text).

Headers read bottom-up: the first server in the chain is at the bottom, the last one before your inbox is at the top.

Which headers actually matter?

A full header dump can be a hundred lines long. Deliverability pros focus on a short list:

• Authentication-Results — the receiving server's official verdict on SPF, DKIM and DMARC. Start here.
• Return-Path — the envelope sender, used for SPF checks. Often differs from the visible From.
• DKIM-Signature — shows the signing domain in its d= tag (e.g. d=google.com).
• Received — one line per server hop, each with IP, hostname and timestamp. Together they trace the delivery path.
• Message-ID — a unique fingerprint for the message.
• Reply-To — where replies actually go; if it differs from From, treat the message with care.
• List-Unsubscribe — present on legitimate marketing mail; its absence on bulk-looking mail is a warning sign.
• X-Spam-Status / X-Spam-Score — the receiving filter's spam verdict and score, when exposed.

How do I read an Authentication-Results line?

This line is the verdict that decides inbox or spam. It looks like this:

Each result is one of:

• pass — the check succeeded. All three passing with aligned domains is the gold standard.
• fail — the check failed. dmarc=fail is what pushes mail toward spam or rejection.
• softfail — SPF failed but the record ended in ~all (soft-fail), so the receiver notes it without acting hard. A sign the record needs tightening — see the SPF guide.
• none — no check was possible, usually because the domain has no published record.
• temperror / permerror — the lookup itself broke (DNS timeout, or too many lookups for SPF).

When mail lands in spam, this line tells you exactly which check failed and for which domain — no guessing needed.

How do I tell who really sent this email?

The From header is just text — anyone can write anything in it. The real identity check is a three-way comparison:

1. From: what the recipient sees.
2. Return-Path: the envelope domain that SPF validates.
3. d= in DKIM-Signature: the domain that cryptographically signed the message.

If all three agree on your domain and dmarc=pass, the message is authentically yours. If the From says your domain but DKIM's d= says something else entirely, that's spoofing or an unauthorised sender — exactly what DMARC enforcement is designed to stop.

How do I trace the path an email took?

Read the Received lines from bottom to top. Each one names a server, its IP, and the time it handled the message. Look for:

• Unexpected hops — relays in countries or networks that have nothing to do with your sending service.
• Time gaps — long delays between hops point to greylisting or a congested relay.
• IP mismatches — a hop claiming a hostname whose IP doesn't belong to your sending provider.

For your own campaigns, the first hop after your sending platform should be a server you recognise — Google's, your SMTP provider's, or your cold-email tool's.

What do spam-score headers mean?

Some servers add lines like X-Spam-Status: Yes, score=7.2 or X-Spam-Level: ******* (one asterisk per point). A score above the server's threshold — commonly 5 — means spam. The detail lines often name the triggered rules, such as missing authentication or suspicious URLs, which tells you what to fix. For a broader walkthrough of the usual culprits, see why emails go to spam.

Analyse headers in seconds

Reading headers by hand is a great skill, but you don't have to do it every time. Paste the raw headers from any message into the free header analyzer tool and it pulls out the SPF, DKIM and DMARC verdicts automatically — handy when you're auditing a client's inbox or checking your own campaigns.