How to read and analyse email headers – the most important lines explained
The header of an email shows the route it took and how the receiving servers checked it. Once you know the most important lines, you can often find SPF, DKIM and DMARC problems in a few minutes.
Where to find the header
Most mailboxes have a function called “Show original” or “View source”. It shows the full header of the message, which you can copy.
The most important lines
- Received: One line per server on the route. The bottom line is the first server, the top line the last one. This shows which server really sent the mail and where delays happened.
- Authentication-Results: The result of SPF, DKIM and DMARC, as the receiving server recorded it. If this line is missing, the recipient did not note the result.
- DKIM-Signature: The signature.
d=shows the signing domain,s=the selector. - X-Spam-Score or similar lines: the spam rating of the recipient, if it sets one.
Typical findings
- The signing domain (
d=) does not match the sender address. DMARC can then fail even though DKIM is valid. - SPF passes for a different domain than the visible sender address.
- One of the servers adds long delays. That points to problems with the sending service.
Our header analyzer reads these lines for you. For the causes of spam, see why emails go to spam.