How to read email headers without guessing
26 July 2026 · 6 min read
Received lines, bottom to top
Each server prepends its own line, so the oldest is at the bottom. Read upward to follow the message from sender to you. Gaps between timestamps show which hop was slow, which is usually the answer to "why did it take twenty minutes".
Authentication-Results is the verdict
Added by the receiving server, it records what SPF, DKIM and DMARC actually concluded. Trust the one added by the server you collect mail from; earlier ones can be forged by anything upstream.
The From: you see is not the From: that was checked
There are two: the envelope sender used for bounces and SPF, and the header From: shown to you. When they disagree, DMARC alignment is what decides whether that matters.
What to look at first
- dkim= and spf= in Authentication-Results.
- Whether the From: domain matches the domain that passed.
- The gap between the first and last Received timestamps.
- Return-Path, which shows where bounces really go.
Our header analyser does this for you if you paste a raw message, but the manual version is worth learning once.
More on guides
Use a subdomain, unless you really mean it
Pointing your main domain’s MX at a new service takes over all of its mail. A subdomain gets you the same feature with none of the risk.
Getting to DMARC p=reject without breaking your mail
The policy is the easy part. Finding everything that sends as you is the work.
How long should a temporary inbox live?
Long enough for a slow verification email, short enough that it is genuinely gone.