Email header explained

Where did an email come from? The answer is in its header fields

The sender name you see is only the surface. Follow Return-Path, Received, and the authentication results step by step to see whether the delivery path matches the claimed identity.

From: Billing <notice@example.test>Return-Path: <bounce@mailer.test>Received: from mx2.mailer.testMessage-ID: <8f31@mailer.test>

Authentication-Results:
 spf=pass; dkim=pass; dmarc=pass

Separate the visible identity from the bounce address

From is the sender identity shown by your email client, while Return-Path receives bounced messages. A mismatch is not automatically suspicious, but the relationship between the domains should make sense.

Read Received from the bottom up

Each receiving server adds its own line at the top, so the bottom line is usually closest to the starting point. Unfamiliar relays, time jumps, and inconsistent domains deserve a closer look.

Finally, check whether authentication aligns

SPF checks the sending server, DKIM checks the signature, and DMARC requires either one to align with the visible From domain. A pass does not make the content safe; it only means the identity chain is more complete.

Field dictionary

Seven essential fields to check

First understand what each field tells you, then combine the evidence. Do not draw conclusions from a single pass result or display name.

From: The sender identity shown to the recipient. The sender can choose it, so assess it together with authentication alignment.
Reply-To: The address used when you click Reply. If it has no apparent connection to From, check whether there is a legitimate business reason.
Return-Path: The address that receives bounced messages. It often belongs to a bulk email provider and may not match the brand domain.
Received: The trail of servers an email passed through, including hosts, addresses, protocols, and timestamps. It is essential for investigating delays.
Message-ID: An email's identifier, usually containing the domain of the system that generated it. A missing or unusual format is only one risk signal.
DKIM: A domain uses a cryptographic signature to prove that parts of the header and the message body were not altered in transit.
DMARC: Requires SPF or DKIM to align with the visible sender domain and specifies how messages that fail authentication should be handled.
List-Unsubscribe: Legitimate bulk emails often provide an unsubscribe option, but check the domain and destination before clicking it.

Security boundaries

Authentication passes do not make an email trustworthy

Attackers can also configure full authentication for domains they control. When an email asks you to make a payment, reset a password, or download an attachment, open the official website independently to verify it instead of using the email's buttons.

Use a temporary email to inspect incoming mail Choose a registration address