The header of an email is the technical part of the message, hidden when you simply read it. It describes who sent it, which servers it went through and how it was checked. When you report spam, a message that does not arrive or a spoofed address, the header lets us trace where the message really came from.
What to know
- The body is what you read; the header travels with it as lines of the form
Name: value.
- Some lines are written by the sender (
From, Subject) and therefore can be forged. Others are added by each server the message goes through (Received) and are far more reliable.
- A full header is long: to have it analysed, copy all of it, without summarising or editing it.
The most useful lines
| Line |
What it tells you |
From |
The displayed sender. Easy to forge. |
To, Cc |
The visible recipients. |
Subject |
The subject. |
Date |
The sending time, as written by the sender. |
Reply-To |
The address that will receive your reply, sometimes different from From. |
Return-Path |
The technical address used for bounce messages. |
Message-ID |
The unique identifier of the message, useful to find it in a server's logs. |
Received |
One line per server crossed, with the time of passage. The most recent one is at the top: to follow the route in order, read from bottom to top. |
Authentication-Results |
The result of the SPF, DKIM and DMARC checks made on reception. |
To understand these checks, see Enabling DKIM, SPF and DMARC to prevent your emails from being flagged as spam.
Displaying the header of a message
The steps depend on your email software: look in the message menu for an entry named View source, Show headers or Properties (the name varies between programs). For Thunderbird, see [Thunderbird] Displaying message headers. For other programs, refer to their documentation.
What to send us
If you open a request about a message, attach the full header, or better the whole message saved as an .eml file. The other useful details to give us are in Information to Provide When You Experience an Email Issue.
Going further
The format of headers is defined by an Internet reference document (an RFC): RFC 5322, which replaces the old RFC 822.