In short
Email headers record where a message travelled, who claims to have sent it and whether it passed authenticity checks. To analyze them: open the original message, check Authentication-Results (SPF, DKIM and DMARC), compare From, Return-Path and Reply-To, and read the Received lines from the bottom up to the first external IP. That IP, with its PTR and ASN, tells you which network the message came from.
How to view the headers
| Client | Where to find them |
|---|---|
| Gmail | The message's ⋮ menu › Show original |
| Outlook on the web | ··· menu › View › View message details |
| Outlook for desktop | Open the message › File › Properties › Internet headers |
| Apple Mail | View › Message › All Headers |
| Thunderbird | Ctrl+U (View Source) |
| Roundcube (cPanel webmail) | More › View source |
When you send a suspicious email to your IT team, forward it as an attachment (or attach the .eml file). A normal forward loses the original headers.
The fields that matter
| Field | What it shows | What to look for |
|---|---|---|
| From | The sender the user sees | The easiest field to fake: compare it with the others |
| Return-Path | The SMTP envelope address, where bounces go | If its domain has nothing to do with the From, be suspicious |
| Reply-To | Where replies will go | Different from the From is typical of BEC fraud |
| Received | Every server the message passed through, with IP and time | Read them from the bottom up |
| Authentication-Results | SPF, DKIM and DMARC results as your server saw them | The most useful field of all |
| DKIM-Signature | The cryptographic signature and the signing domain (d=) | The d= domain should match the From domain |
| Message-ID | Unique identifier assigned when the message was created | An unrelated domain here gives away the real software or server |
| X-Spam-Status | The SpamAssassin score | Which rules fired |
An annotated example
Here is a simplified phishing email impersonating a supplier. The IPs and domains are examples:
Received: from mail.example-hosting.eu (mail.example-hosting.eu [192.0.2.10])
by mail.yourcompany.eu with esmtps; Tue, 13 Oct 2026 15:41:07 +0200
Received: from [203.0.113.77] (port=51234 helo=WIN-8KQ2)
by mail.example-hosting.eu with esmtpa; Tue, 13 Oct 2026 13:41:05 +0000
Authentication-Results: mail.yourcompany.eu;
spf=pass smtp.mailfrom=billing@supplier-payments.eu;
dkim=pass header.d=supplier-payments.eu;
dmarc=pass header.from=supplier-payments.eu
From: "Supplier Ltd" <billing@supplier-payments.eu>
Reply-To: supplier.payments@gmail.com
Return-Path: <billing@supplier-payments.eu>
Subject: Outstanding invoice - new bank details- Everything passes SPF, DKIM and DMARC. That only proves the message came from whoever controls supplier-payments.eu, not that this is your real supplier's domain (which might be supplier.eu).
- The Reply-To is a Gmail account. If you reply, the conversation continues with the attacker.
- The first Received line (the bottom one) shows the message entered from IP 203.0.113.77, from a machine called WIN-8KQ2 that logged in to a hosting provider: a compromised account or one created for the attack.
- The subject asks you to change bank details: the classic fraud signal.
How to read the Received lines
Each server that receives the message adds its own Received line above the previous ones. That's why you read them from the bottom up: the bottom one is the origin and the top one is your own server.
You can only trust lines added by servers you control or have verified. An attacker can invent fake Received lines below the real ones to mislead you. The rule of thumb: find the first line, from the top, where a trusted server says it received the message "from" an external IP. That is the real source IP.
What SPF, DKIM and DMARC results mean
| Result | Meaning | Watch out for |
|---|---|---|
| spf=pass | The source IP is authorized by the Return-Path domain | That domain may not be the From domain |
| spf=fail or softfail | The IP isn't authorized | Also happens with legitimate forwarding |
| dkim=pass | The content is unchanged and was signed by the d= domain | Anyone can sign with their own domain |
| dmarc=pass | SPF or DKIM passes and its domain matches the From domain | The only proof the From isn't forged |
| dmarc=fail | The From uses a domain that didn't authorize this send | A strong sign of spoofing |
In short: dmarc=pass says the From domain is genuine. It doesn't say the domain is the one the user thinks it is. Lookalike domains, freshly registered and properly configured, pass every check.
Trace the source IP and its network (ASN)
With the source IP you can find out which network it belongs to, whether it's a legitimate mail server or a home connection, and who to report abuse to:
# Reverse name (PTR) of the IP
dig -x 203.0.113.77 +short
# Network and ASN (autonomous system number) via Team Cymru
whois -h whois.cymru.com " -v 203.0.113.77"
# IP block details and abuse contact
whois 203.0.113.77 | grep -iE "orgname|org-name|country|abuse"The ASN tells you which company operates the network: a cloud provider, a hosting company or a residential ISP. If lots of spam comes from the same ASN, you can report it to its abuse contact or, as a temporary measure, block that range on your server.
Phishing signs in the headers
- dmarc=fail with a From address from a bank, a government agency or your own company.
- A Reply-To on a free service (Gmail, Outlook.com) when the From is a business.
- Return-Path and From on unrelated domains.
- A domain similar to the real one: swapped letters, hyphens or a different ending (.co instead of .com, -payments.eu).
- The originating Received line from a residential IP or a country where the sender doesn't operate.
- A Message-ID with a domain unrelated to the sender.
Frequently asked questions
Can email headers be faked?
Some can: From, Reply-To and the older Received lines are written by the sender. The ones your own servers add, such as Authentication-Results and the top Received lines, are trustworthy.
If an email passes SPF, DKIM and DMARC, is it safe?
Not necessarily. It only proves the sender's domain is genuine. An attacker can register a domain similar to the real one and configure it correctly.
How can I tell which country an email was sent from?
Find the source IP in the Received lines and look it up with whois. It shows the country of the IP block, although the attacker may be using a rented server in another country.
What is an IP's ASN?
The autonomous system number: it identifies the company operating that network, such as a cloud provider or an ISP. It tells you who to report abuse to.
Protect inbound email on your whole server
Clisec checks SPF, DKIM, DMARC, sender reputation and impersonation signals on every inbound email, before delivering it.