How to Analyze an Email Header to Trace Email Route, Spam or Phishing

When you open an email, you can see the sender details, subject line, date and time of the email, and your email address. This is the simplified version of an email header. There are many other hidden gems that you might find difficult to understand and analyze.

This guide will help you become a pro at understanding email header by breaking down the component of the header.

Table of contents

• What is an email header?
• What is the purpose of an email header?
• What are the components of an email header?
• How to find an email header in different email clients?
• Conclusion

What is an email header?

The email header contains the technical details of an email that shows the sender and recipient details, the path of the email, return address, authentication status, and much more.

When you open an email, you can see the following basic information in the email header:

• From: This section refers to the name and email address of the sender.

• To: This section refers to the name and email address of the recipient. If there are multiple recipients, each recipient's name and email address will appear in this section.

• Date: This section refers to the sent email’s day and time.

• Subject: This is the subject line displayed in your inbox.

But, there is much more in the background that you cannot see without clicking on the original message source in your respective email client. We will be discussing that in a bit, but first, let’s discuss the importance of the email header.

What is the purpose of an email header?

The email header serves the following purpose:

• Gives information about the sender

The email header gives you the sender in the From section and the timing and date of the message sent. Without this information, you might struggle to find the sender's details and if the email is safe to open or not.

Besides, if you view the source of the email in your respective ESP, you can get more insights into the sender, such as a reply-to address, authentication status, etc.

• Helps you identify phishing or spam emails

Headers are the source for differentiating the legitimate and spam emails. Mailbox spam filter analyzes the email header to check for authentication status, sender details, email route, etc.

Such detailed information helps ESPs detect phishing and spam emails and put them in the junk folder.

Related guide: How To Detect Phishing Emails And Safeguard Against Them

• Helps you identify the email route

You can analyze the time and route of the email from the sender’s mail server to your inbox with headers.

When a user sends an email, it travels through several Mail Transfer Agents (MTAs) before reaching the intended recipient.

The information under the Received from section can help you track the email route — allowing them to check all the MTAs the email passed through to arrive at its destination. Furthermore, you can also obtain the IP address of the sender to track the message source further.

What are the components of an email header?

Some of the major things you can see in an email header are as follows:

1. Authentication check

This section shows the SPF, DKIM, and DMARC status. If all three authentications are shown as passed, it means the email provider validates the sender's IP address.

2. Return Path

If an email fails to land in the intended inbox or bounces, it will be delivered to the address mentioned in the return path section. The return path can be the same as the sender’s address, but it might make sense to have an email that will collect bounces and do something if there is high volume.

3. Received from

This section shows the SMTP hop or the path email took when it was sent by the sender server and reached your inbox.

Multiple SMTP hop can indicate the multiple touchpoints email went through while reaching the recipient's inbox.

Related guide: Everything About SMTP or Simple Mail Transfer Protocol

4. Transport layer security (TLS )

TLS is a protocol that encrypts and delivers email securely. It helps prevent eavesdropping between mail servers – keeping the messages private while moving between email providers.

Gmail is among one of the mail providers that include TLS in the header. If the TLS is not there, then the Internet Service Provider (ISP) will show a red unlocked icon near the front address indicating that the message reached the recipient but wasn’t encrypted.

5. Authenticated received chain (ARC)

ARC encapsulates all the authentication pieces.

6. Other information you can find in the header

• Content-type: This section refers to media types of email content, consisting of a type and subtype. The content type here is set to multipart/alternative, which means if an email client doesn’t render any elements of an email, it’ll show its fallback version.

• MIME-Version: Multipurpose Internet Mail Extensions (MIME) -version is an internet standard that supports email attachments outside of the main message, like static images, video, GIFs, and audio components. MIME-Version is a required header indicating that this message is to use the rules of MIME. "MIME-Version: 1.0" is the only currently defined MIME-Version header allowed.

• List-Unsubscribe: When you unsubscribe from an email, your email address is collected on the email address mentioned in this section.

• X-Report-Spam: When you mark the email as spam, the notification goes to the email address mentioned in this section

• X-Report-Abuse: When you mark the email as abuse, the notification goes to the email address mentioned in this section.

How to find an email header in different email clients?

All mail providers allow you to see the source of the incoming email or the email header, which we have discussed in the following sections:

Read and find an email header in Gmail

In Gmail webmail, follow these steps to check the email header:

• Open the message, and in the left corner, click on the three dots.

• Then click on the “Show original.”

An email header in Gmail webmail looks like this:

Read and find an email header in Outlook

On the Microsoft Outlook website, follow these steps to check the email header:

• Click the three dots in the upper right corner of the email.

• Then, click on the “View ” in the menu to view the full email header.

An email header in Outlook will look like this:

Read and find an email header in Apple Mail

In Apple Mail, follow these steps to check the email header:

• Select the “View” option in the menu pane and choose the “Message” option.

• Then, click on the “Raw Source” option.

Read and find an email header in Yahoo

In Yahoo Mail, follow these steps to check the email header:

• Open the message and click the “More” button above it.

• Then, click “View Raw Message".

Conclusion

Analyzing an email header might seem daunting due to technical details. But, it is really helpful in understanding the email infrastructure and spotting any spam email by verifying the authenticity of the sender.

But, you don't need to go through the entire header; just check the major component we mentioned in this guide, and you’ll become a pro at it in no time. Furthermore, you can read guides on how to identify and safeguard against spoofed email addresses to protect yourself from potential email scams.