How to Read Email Headers to Trace Senders and Spot Spoofing

Email headers are the hidden metadata at the top of every message, recording every server it passed through and whether it passed authentication. If you want to know who really sent a message, why it landed in spam, or whether it was spoofed, the headers hold the answer. Here is how to read them.

What email headers tell you

Every email carries a stack of headers most clients hide by default. Once you paste the raw headers into the Email Header Analyzer, you can read the full story:

The delivery path: each Received line is one hop, listed newest first. Reading bottom to top shows the true route from sender to inbox.
The real sender: the originating server and IP, which often differs from the friendly “From” name.
Delays: timestamps between hops reveal where a message sat and why it arrived late.

Checking SPF, DKIM, and DMARC

The most useful part of any header is the authentication block. These three checks tell you whether the message is genuine:

SPF confirms the sending server is allowed to send for that domain.
DKIM verifies the message was signed and not altered in transit.
DMARC ties the two together and tells receivers what to do on failure.

A pass on all three is a good sign. A fail or softfail is a strong indicator of spoofing or a misconfigured domain, and a common reason legitimate mail gets filtered. The analyzer surfaces these results so you do not have to hunt through raw text.

How to view and paste raw headers

The tool reads headers you paste, so grab them from your client first:

In Gmail, open the message, click the three-dot menu, and choose “Show original.”
In Outlook, open the message, go to File then Properties, and copy the “Internet headers” box.
Select all of the raw text and copy it.
Open the Email Header Analyzer and paste it into the box.
Read the parsed delivery path and authentication results.

Everything runs in your browser. The tool analyzes the text you paste and never fetches or sends anything, so a sensitive message stays on your device.

When to use this

Reach for header analysis when an email looks suspicious, when a customer says your mail never arrived, or when you are debugging deliverability after a domain change. The headers turn a guessing game into a clear, traceable record.

Fixing an SPF failure you found? Build a correct record with the SPF Record Generator.
Tightening your domain policy? Use the DMARC Record Generator.
Hardening the wider stack? Try the Security Headers Generator.

Paste your headers, read the path, and let the authentication results tell you who really sent it.