How to read and interpret raw headers?

Someone's email isn't arriving, or it's landing in spam instead of the inbox. You've been told to "check the headers." Raw email headers can look like dense technical noise when you first open them, but they're built on predictable patterns and you'll get the hang of it quickly.

The first thing to know: read Received headers from bottom to top. Every server that handles a message adds a Received header at the top. The bottom-most Received header is where the message started; the topmost is where it ended up. Reading them in reverse gives you the chronological delivery path. Each hop has timestamps, which lets you see if any server introduced unusual delays.

And once you've traced the path, focus on a few key headers. From shows the display sender address (what recipients see). Return-Path shows the envelope sender, which is what SPF checks against. DKIM-Signature shows the signing domain and selector. Authentication-Results is the most useful for debugging: it shows whether DKIM, SPF, and DMARC all passed. If any of them failed, that header usually tells you why.

To get raw headers: in Gmail, open the message, click the three-dot menu, and choose "Show original." In Outlook, open the message properties. On Apple Mail, view the message source. You can then paste the full output into our free Email Header Analyzer for a formatted breakdown that's much easier to read than the raw text.