Every email you receive carries metadata most people never open. It hides behind a “Show original” or “View source” button and tells you, in detail, the route the message took and who really sent it. Learning to read the email headers is one of the cheapest skills in personal security — about five minutes to pick up, and it pays off the next time something feels slightly off. Running an email service myself, these are the lines I check first when a message looks wrong.
What email headers actually are
An email is more than what you see. Every message has a body — the words and pictures — and a long list of headers carrying routing and authentication data: who sent it, who received it, the path between mail servers, and whether each server trusted it. The visible “From” line is just a label set by whoever sent the message; it can say anything. The real origin lives in the headers, and that is far harder to fake convincingly. Spoofing the visible name is the heart of most phishing, which is why headers are worth knowing.
How to see the headers in common clients
- Gmail: open the message, three-dot menu, “Show original.”
- Outlook on the web: three-dot menu, “View” then “View message source.”
- Apple Mail: View, Message, All Headers.
- Thunderbird: View, Headers, All.
You will see a wall of text. You only need to know what to look for.
The three authentication lines you care about
Mail servers run three checks on incoming messages — SPF, DKIM, and DMARC — each answering a slightly different question about whether the sender is who they claim.
SPF
The Sender Policy Framework checks whether the sending server is allowed to send for the domain in the From line. Look for spf=pass. A fail means the message claims a domain that never authorized that server — a strong spoofing signal.
DKIM
DomainKeys Identified Mail attaches a cryptographic signature verified against a public key in the sender’s DNS. Look for dkim=pass. A fail or missing DKIM on mail claiming to be from a major company is suspicious; banks and big retailers sign everything they send.
DMARC
DMARC ties SPF and DKIM together and sets the policy when they fail. You want dmarc=pass from any serious organisation. A message claiming a major brand with spf=fail dkim=fail dmarc=fail is almost certainly forged — no legitimate large sender ships mail that fails all three.
The Received chain
Headers also stack Received: lines, one per hop, read bottom to top. The bottom line is the first server to handle the message, usually the sender’s. Glance at it and ask whether the origin makes sense. A “household-name bank” originating from a residential IP in an unrelated country is a quick red flag.
The Reply-To trick
Phishing often sets a real-looking From while quietly using a different Reply-To, so your reply lands with the attacker. Compare From: and Reply-To:. A message from support@yourbank.com with a reply-to of random@gmail.com is not from your bank.
A quick worked example
Say you get mail that looks like a major payment provider asking you to confirm a charge. Open the headers:
From: "PayPal Support" <support@paypa1-secure.com> Reply-To: refund-team@mailbox-help.net Authentication-Results: mx.example.com; spf=fail (sender IP is not authorized); dkim=none; dmarc=fail Received: from unknown.host (192.0.2.45) by mx.example.com
The picture is clear without any training: the sender domain swaps a lowercase “l” for a digit, the reply-to is unrelated, SPF failed, DKIM was not even attempted, DMARC failed, and the origin is a residential IP. Delete and move on.
What real companies look like
For contrast, a genuine notification from a major service shows three clean passes, a From and Reply-To on the company’s own domain, and a sending server belonging to the company or a known transactional provider. Open the headers on an email you trust and get used to what “normal” looks like for the senders you deal with.
Why this skill pays off
Spam filters catch most spoofed mail, but the most dangerous phishing is built precisely to slip past filters. Those are the messages you judge by hand, and a 30-second header check often settles it. You do not read every header on every message — you just know how, so on the rare off day, you can look.
One last habit
Pair header literacy with the habits that keep phishing away in the first place: use a temporary email for low-trust sign-ups so fewer lists hold your real address (here are ten times that helps), a password manager so a successful phish cannot autofill on a fake domain, and two-factor authentication on the accounts that matter. Headers are the last line of defense for the few suspicious messages that get through — the fewer of those, the easier the job.