Email header analysis is the process of opening the raw metadata behind a message — the routing entries, authentication results, and identifiers that your inbox hides by default — to determine where the message really came from and whether the sender is who they claim to be. Every email carries this data, and reading it correctly is how you tell a legitimate message from a forged one. Preserving it correctly is how you keep that determination usable later, whether for an IT ticket, an HR file, or a court case.
The rest of this guide walks through opening the raw header in the major mail clients, the fields worth your attention, the authentication codes that expose spoofing, and the preservation rules that keep the record intact.
Open the Raw Header First
Every mail client hides headers behind a slightly different menu. The goal in each case is the same: reach the raw text without altering it, then copy it into a plain text file before doing anything else.
- Gmail: open the message, click the three vertical dots next to the Reply button, and select “Show original.” A new tab opens with the full raw header and a summary of SPF, DKIM, and DMARC results at the top.1Google Help. Trace an Email With Its Full Header
- Classic Outlook (desktop): double-click the message to open it in its own window, go to File, and select Properties. The internet headers appear in a scrollable text box at the bottom.2Microsoft Support. View Internet Message Headers in Outlook
- Outlook on the web: open the message, click the three-dot icon near Reply, select View, then View message details.
- Apple Mail: select the message, then choose View → Message → All Headers.3Apple Support. Show Detailed Headers in Mail on Mac
- Yahoo Mail: open the message, click the More icon (three dots), and select “View Raw Message.”4Yahoo Help. Check Info Failed Delivery Messages
Copy the raw text into a plain text editor and save it before you start reading. That preserves the original state in case you need it.
The Fields That Actually Tell You Something
Most of the lines in a header exist for the mail servers, not for you. A handful matter for tracing origin and spotting forgery.
The From field is the display address the recipient sees. It is the easiest field to forge and should never be trusted on its own. The Return-Path is the address that receives bounce notifications if delivery fails; a mismatch between From and Return-Path is the first thing to check when something looks off. The Reply-To, if present, is where responses go when you hit Reply.
The Received lines form a chain of entries added by each server that handled the message, each stamped with a timestamp and IP address. These are the backbone of any tracing work. The Date field records when the sender’s mail server accepted the message, including time zone. The Message-ID is a unique string assigned by the first mail server, useful as a serial number for deduplication and tracking.
X-Mailer names the software or web interface used to compose the message. A bulk-mailing tool listed here on a message that claims to come from a personal corporate account is a red flag. MIME-Version and Content-Type describe body encoding and occasionally reveal the generating software, which can matter in phishing investigations.
Reading the Received Chain
Read the Received lines from bottom to top. The bottom-most entry is the first server that touched the message; each line above it records the next handoff until delivery landed in your inbox. Every entry shows a server name or IP address and a timestamp.
The originating IP address usually sits in that bottom entry, near the word “from.” It only appears reliably when the sender used a traditional mail server or a desktop client. Gmail’s web interface does not include the sender’s IP in outgoing headers for standard @gmail.com and @googlemail.com accounts, and Outlook.com behaves similarly for consumer accounts. For a message sent through one of those webmail services, the earliest Received line will show a Google or Microsoft data center address, not the sender’s home or office network. Corporate mail servers, custom-domain Google Workspace accounts, and desktop clients are more likely to expose the originating IP.
When an originating IP is present, you can check it against geographic databases or reputation blacklists to see whether the message came from an unexpected region or a server known for sending spam. Investigators also compare Received timestamps against other system logs to corroborate or contradict the claimed timing of events.
SPF, DKIM, and DMARC in the Header
The authentication results are the strongest anti-spoofing data in the header. Skip them and you are working blind.
SPF
Sender Policy Framework lets a domain owner publish a list of servers authorized to send mail on its behalf. The receiving server checks whether the sending IP is on that list. The result appears in the Authentication-Results line: pass means the server was authorized, fail means it was not, softfail means the domain does not vouch for that server but is not blocking it, and none means the domain published no SPF record at all. A none from an organization that should know better is itself a warning.
DKIM
DomainKeys Identified Mail attaches a cryptographic signature to the message. The sending server signs with a private key; the receiving server retrieves the matching public key from DNS to verify. The DKIM-Signature field contains a d= tag naming the signing domain and an s= tag naming the specific key (a selector). Success shows as dkim=pass. Failure means either the message was altered in transit or the signature was forged.
DMARC
DMARC adds an alignment requirement to SPF and DKIM: the domain that passed authentication must match the domain in the visible From header. A message can show spf=pass and still produce dmarc=fail when the authenticated domain does not align with the From domain. That mismatch is the signature of most sophisticated phishing: the attacker routes mail through a server that legitimately passes SPF for one domain while spoofing a different domain in the From field. When you see dmarc=pass, the message has cleared the highest bar currently available for sender verification.
Spotting a Spoofed Sender
Forging the From field is trivial. Forgeries fall apart in the authentication and routing data.
Start with a three-field comparison: From, Return-Path, and Reply-To. In a legitimate message from a well-configured sender, the domains should either match or clearly belong to the same organization. When the From reads billing@yourbank.com but the Return-Path points to a random domain and the Reply-To goes somewhere else entirely, you are almost certainly looking at phishing.
Then read the Authentication-Results line. A legitimate corporate sender should show spf=pass, dkim=pass, and dmarc=pass. The most dangerous phishing passes SPF for whatever domain the attacker actually controls while failing DMARC alignment against the domain shown in the From field. That is the exact scenario DMARC was designed to catch. If you see dmarc=fail, treat the From address as unreliable regardless of what it says.
Finally, scan the Received lines for inconsistencies. A message claiming to come from a large company whose first hop is a residential IP in an unexpected country warrants skepticism. Gaps in timestamps or unusual server names mid-chain can indicate the message was relayed through a compromised machine.
Preserving Headers as Evidence
If there is any chance the message will matter in a legal dispute, an investigation, or an HR proceeding, how you save it matters as much as what it says.
Save the Full Message, Not a Screenshot
The simplest preservation method is copying the full raw header text into a plain text editor and saving as .txt. Avoid word processors; hidden formatting codes can corrupt the technical strings. A better option is saving the message as an .eml file, which captures both header and body in a single file following the MIME standard and retains the original structure as the server received it. Most forensic analysis tools accept .eml natively.
Hash the File
After saving, generate a SHA-256 hash of the file. SHA-256 produces a fixed-length string from any input, and a single changed character produces a completely different hash. Record the hash value separately, in a log or a timestamped memo. If anyone later questions whether the file was altered, recalculating the hash and comparing it to the original value proves the content is identical. Any SHA-256 calculator works; document which file was hashed and when.
What Not to Touch
Never edit, rearrange, or truncate the Received lines. They document the exact path the message traveled, and any modification undermines the record. The same applies to the Authentication-Results line and the DKIM-Signature field. If you need to annotate for your own notes, do it in a separate document, not in the preserved file.
Legal Exposure for Altering or Losing Header Data
Tampering with email headers can trigger both criminal and civil consequences, and the penalties reach further than most people expect.
Federal law makes it a crime to alter, destroy, or falsify any record with the intent to obstruct a federal investigation. Email metadata is included. The penalty is a fine, up to 20 years in prison, or both.5Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy The statute does not require the person charged to be the target of the investigation.
In civil litigation, email headers qualify as electronically stored information. If a party fails to take reasonable steps to preserve that data and it is lost, a court can impose sanctions under the Federal Rules of Civil Procedure. The remedy depends on the party’s mental state. Negligent loss that prejudices the other side draws curative measures. Intentional destruction to deprive the opponent of the evidence escalates dramatically: the court can instruct the jury to presume the missing evidence was unfavorable, or it can dismiss the case or enter a default judgment outright.6Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
Even absent intentional destruction, a modified header faces an uphill battle in court. Federal Rule of Evidence 902(13) allows electronic records to be admitted without live witness testimony, but only if a qualified person certifies that the electronic process or system produced an accurate result.7Legal Information Institute. Federal Rules of Evidence Rule 902 – Evidence That Is Self-Authenticating If the header was edited after collection, no honest certifier can make that attestation. The opposing party can also challenge authenticity under the general authentication rules. This is why hashing immediately after preservation matters: it provides mathematical proof that the content has not changed.
Turning an IP Into a Name Requires Legal Process
Header analysis can give you an originating IP address, but converting that address into a subscriber identity is not something you do on your own. The Stored Communications Act sets out the process. Basic subscriber information — name, address, payment method, session times, and IP addresses — can be obtained through an administrative subpoena, a grand jury subpoena, or a court order.8Office of the Law Revision Counsel. 18 USC 2703 – Required Disclosure of Customer Communications or Records Accessing the actual content of stored communications requires a warrant.9Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA) If you are a private party, this generally means working through counsel or law enforcement rather than approaching the email provider directly.
Free Tools for Parsing Headers
Reading raw header text line by line works but is tedious for messages that passed through many servers. Two free tools handle the formatting and math.
Google’s Admin Toolbox Messageheader lets you paste raw header text into a web form. It normalizes timestamps across hops, calculates the delay at each server, and flags the hop that caused the longest delay.10Google Admin Toolbox. Messageheader No Google Workspace account is required. Microsoft’s Remote Connectivity Analyzer includes a Message Header Analyzer that displays total delivery time, breaks out individual hops, and sorts headers by name or value. Both tools work with headers from any standard mail server.
Neither tool stores your data permanently, but if the header contains sensitive information, copy only the header portion, not the message body, before pasting. And remember that these tools help you read the data; they do not authenticate it. A forged header fed into either tool produces a clean-looking analysis of forged data. Verification still depends on the authentication fields and, where available, cross-referencing against server logs.