Guide to Reading Email Headers

The process that transmits an email from the sender to you is not very different from regular paper mail. In fact, the system closely resembles a combination of the processes taken by the old Pony Express and the United States Post Office. Like these services, a record exists within your email of each step along its route to your inbox and is used in email management.

Getting this information is as simple as telling your email program to display the full header for your messages. You will find out a lot about the sender, their Internet Service Provider, and even your own ISP. Having this information helps you verify senders and trace bogus and spam messages back to their source. Look at each part of the full header for important clues about spam.

The information contained in a full email header is standard, regardless of the origin and destination. Read the routing for any email that you receive, in reverse order to find the email's origin.

Each time the email is transferred, the transfer agent adds a new line that shows what service received it, what service transferred the email, for what recipient, and by what type of mail service. Email sent through ISPs use the SMTP notation to show a mail transfer. Webmail services like Gmail, yahoo, and hotmail will show an HTTP (internet) transfer.

The Delivered line does not always appear in the full header. The delivery date and time are always displayed in the header as local time offset from Universal Time. (EST displays as the Universal Time minus 5 hours). The sender's time should also display as an offset from UT.

Each mail agent adds a message I.D. simply for tracking purposes. This information is only useful to that service. Each transfer service's IP address should appear too. You can verify the validity of routing information in the header lines by looking up the IP information in the header online.

To, without a colon, may not match the recipient's actual email. The return path, usually found at the top of the header, should match the sender's email at the bottom of the header. From, without the colon that appears when you compose an email, signifies an unverified envelope sender. That does not mean the mail is bogus, but you should trace the route that it took before it reached your inbox. Spammers and phishers hope you won't.

Anatomy of E-mail Messages

Email Headers Explained

E-mail Spoofing

Full Email Headers

How to Read Email Headers

Reading Email Headers