How to Read Email Headers

Learn which email headers explain sender identity, delivery path, and authentication results.

Start with Authentication-Results

Authentication-Results is the quickest summary of SPF, DKIM, and DMARC. If one of them is missing or failing, delivery and trust can suffer.

Look for pass, fail, neutral, or none values, then compare the domains shown next to each result.

Each Received line is added by a mail server. The oldest hop is usually near the bottom and the newest hop is near the top.

Unexpected hops, private relays, or mismatched hostnames can explain delays or suspicious routing.

Recommended next steps

Turn this guide into a concrete DNS report for your own domain.

Generate SPF and DMARC records before publishing DNS changes.

Paste raw email headers to inspect routing hops, authentication results, and message metadata.

Find the SPF TXT record that controls which senders can mail for a domain.

Look up a DKIM selector record and inspect the public key published for a domain.

They provide useful evidence, but spoofed or incomplete headers still need careful interpretation.

Start with Authentication-Results and Received, then compare SPF, DKIM, DMARC, From, and return-path domains.