Message evidence guide
Email headers explained in plain language
Email headers record several identities and delivery events. Reading them in the right order is more useful than searching for one suspicious word.
From is the identity shown to the reader
The From field is the address most mail apps display. It can be legitimate, forged or merely misleading. Treat it as a claim that needs support from authentication and context.
Reply-To and Return-Path serve different jobs
Reply-To controls where a normal reply goes. Return-Path is the envelope address used for delivery status and SPF. Different domains can be legitimate in managed platforms, but an unexpected reply destination often explains the sender's objective.
Received lines form a delivery trail
Each mail system adds a Received line as it accepts the message. Read the chain from the bottom upward to follow the earliest visible hop toward your mailbox. A private address or missing hop is not automatically malicious; focus on boundaries your provider authenticated.
Authentication-Results summarizes checks
SPF, DKIM and DMARC results are normally written by the receiving system. A pass is meaningful for the domain named beside it, so read both the result and domain. DMARC alignment connects an authenticated identity to the visible From domain.
Message-ID and URLs help group cases
Message-ID can identify a delivery, while subjects, body fingerprints and link domains can connect related copies. URL text may be encoded or wrapped by a security service. Extracting it from the original source is safer than clicking to discover it.
Action checklist
- Compare From, Reply-To and Return-Path.
- Read SPF, DKIM and DMARC as separate results.
- Follow Received headers from the trusted receiving side backward.
Questions people ask
Which header should I check first?
Start with From, Reply-To, Return-Path and Authentication-Results, then use Received lines for delivery context.
Can headers prove who the human sender is?
They can support service and domain attribution, but they rarely prove a person's identity by themselves.