Every email carries a hidden record of where it really came from. You don't need any special software to read it — just your own mail app and about five minutes. Here is how to find the header, what to look for, and how to tell a genuine message from a convincing fake.
An email header is the hidden log at the top of every message that records where it came from and how it reached you. To read it, open the message and choose “Show original” (Gmail), “View message source” (Outlook), or “All Headers” (Apple Mail). Look at three things: whether the From address matches the real Return-Path and Reply-To, the chain of Received servers, and the Authentication-Results line, where you want spf=pass, dkim=pass, and dmarc=pass. A fail is a strong sign of a fake — but a pass alone never proves a message is safe.
When you look at an email, your app shows you the friendly version: a sender's name, a subject, a date. Underneath that is the header — a technical record, written by the mail servers themselves, of every hop the message made from the sender to you. It is difficult to fake completely, because each server adds its own stamp along the way. That is why, when a message looks suspicious, the header is the honest place to check.
You already have everything you need. The exact steps depend on your app:
What you see will look like a wall of text. You only need a few lines of it.
The name you see in your inbox is chosen by whoever sent the message — it proves nothing. Look instead at three fields:
If the From says your bank but the Return-Path or Reply-To is some unrelated address, that mismatch is a classic sign of a fake.
Modern mail servers check three things and record the outcome in an Authentication-Results line. A healthy one looks like this (the important parts highlighted):
You want to see pass on all three, tied to the same domain the message claims to be from. A fail or softfail on the From domain — especially for a message asking for money or a password — is a strong signal of spoofing. Be careful to check the domain each result is tied to: a scammer's mail can honestly pass SPF and DKIM for their own throwaway domain while spoofing the name in the From field.
The Received lines read bottom-to-top: the oldest server (the origin) is at the bottom, your own mail server at the top. If a message claims to be from a major company but the earliest Received line is an unrelated server in an unrelated place, treat it with suspicion.
A clean header proves the message really came from that account. It does not prove the request inside it is safe. When a criminal takes over a genuine account — a vendor, a title company, a friend — and writes to you from it, every check passes perfectly. That is why the last line of the checklist matters most of all: verify any request for money or personal information through a channel you already trust, no matter how clean the header looks. Header analysis narrows the odds; it never replaces that phone call.
Sources & further reading: Google & Microsoft support documentation on viewing message source and authentication results · CISA guidance on recognizing and reporting phishing. Educational only; when in doubt, don't act on the message — report it.
An email header is the hidden record at the top of every message that logs where it came from and how it traveled to you. Your mail app shows you the friendly parts — sender name, subject, date — but the full header lists every server the message passed through and the results of the authentication checks, which is where the truth about a fake message usually shows.
In Gmail, open the message, click the three-dot menu, and choose “Show original”. In Outlook on the web, open the message, click the three-dot menu, and choose “View” then “View message source”. In Apple Mail, open the message and choose View, then Message, then All Headers.
They tell you whether the message was authorized to come from the domain it claims. In the Authentication-Results line, you want to see spf=pass, dkim=pass, and dmarc=pass. A fail or softfail on the From domain is a strong sign of spoofing. But a pass only proves the sender is genuine — it does not prove the message is safe, because a real hacked account passes every check.
Not necessarily. A clean header proves the message really came from that account — not that the request inside it is legitimate. A criminal who has taken over a real account passes every authentication check. Always verify any request for money or personal information through a channel you already trust, no matter how clean the header looks.
Family Sentinel reads the header, the links, the attachments, and the intent of every message in a monitored inbox — and warns a person you choose when something is wrong. Or check your own domain's spoofing protection right now, free.