How to Read an Email Header to Spot a Fake Sender

To read an email header, open the full message source and check four things. See whether Return-Path matches From, where Reply-To sends replies, where the oldest Received line starts, and what SPF, DKIM and DMARC say in Authentication-Results. A mismatch or a failed check is a strong sign of a fake sender. No single field proves an email is safe, so always confirm payment requests by phone.

Introduction

The name on an email is easy to fake. So are the address, the logo and the signature. A finance clerk in Dubai can receive a message that looks exactly like it came from the CEO, and nothing on screen looks wrong.

The email header is different. It is the hidden record of how a message travelled, and it is much harder to forge. Once you know where to look, reading it takes about two minutes.

This guide shows you how to open the header in Gmail, Outlook and Apple Mail. You’ll learn the five fields that matter, how to read SPF, DKIM and DMARC results, and what a fake header looks like next to a real one. We also cover the limits, because a clean header doesn’t always mean a safe email. If you want the background on how attackers pick their targets first, start with our guide to phishing, spear-phishing and whaling.

What Is an Email Header and Why Does It Reveal a Fake Sender?

An email header is the technical block of data attached to every message. It records who sent it, which servers handled it and whether it passed security checks. A fake sender can change the name you see, but the header shows the real route and the authentication results.

Every email has two layers. The visible layer is the display name, the From address, the subject and the body. The sender controls all of it, which is why it is so easy to fake.

The hidden layer is the header. Each mail server that touches the message adds its own lines to it. Your own mail provider adds the final lines, and the attacker can’t edit those. That is why the header is the best evidence you have.

How Do You View the Full Email Header in Gmail, Outlook and Apple Mail?

Open the message, then choose the option that shows the full source. In Gmail it is Show original. In Outlook it is Properties, under the File menu. In Apple Mail it is All Headers, under the View menu. Copy the text and read it in a plain text editor.

Here are the exact steps for each app:

1. Gmail: Open the email, click the three dots next to Reply, then choose Show original.
2. Outlook desktop: Double-click the email to open it, then go to File and Properties. The header sits in the Internet headers box.
3. Outlook on the web: Open the email, click the three dots, then choose View and View message details.
4. Apple Mail: Select the email, then go to View, Message and All Headers.

Mobile apps often hide the header completely. If you’re on your phone, forward the suspicious email as an attachment to yourself or to your IT team. Then open it on a desktop. Don’t click any links or open any attachments while you do this.

The 5 Header Fields That Expose a Fake Sender

A raw header can run to hundreds of lines. Most of it is routing noise. These five fields do the real work:

Field	What it shows	Red flag
From	The sender name and address you see	A domain that is a near-copy of the real one
Return-Path	Where bounce messages go	A different domain from the From address
Reply-To	Where your reply will land	A different domain or a free email address
Received	Each server the email passed through	An oldest hop from an unknown or unrelated server
Authentication-Results	The SPF, DKIM and DMARC verdicts	fail, softfail or none

From and Return-Path

The From address is what you see in your inbox. The Return-Path is the address that receives bounce messages, so it shows where the email really came from technically. If From says your supplier but Return-Path points to an unrelated domain, look closer.

A mismatch isn’t always fake. Newsletter and invoicing platforms often use their own Return-Path for real mail. Treat a mismatch as a reason to dig deeper, not as proof.

Reply-To

Reply-To decides where your answer goes when you hit reply. Attackers love this field. The From line shows a trusted name, but the Reply-To quietly points to an address they control.

This is a classic trick in payment fraud. The email looks like it came from your CEO, and your reply goes straight to the attacker.

Received lines

Every server that handles the email adds a Received line at the top. That means you should read them from the bottom up. The bottom line shows where the message first entered the mail system.

If an email claiming to be from a local bank started on an unknown server in another country, that’s a problem. One caution applies here. Lines near the bottom can be forged by the attacker. The lines added by your own provider, at the top, are the ones you can trust most.

Authentication-Results

This line is added by your own mail server and is the single most useful part of the header. It shows whether the message passed the sender checks. We cover it in detail in the next section.

One bonus clue is the Message-ID. It usually ends with the domain of the system that created the message. If an email claims to come from one company but the Message-ID points to something unrelated, note it as an extra warning sign.

How Do You Read SPF, DKIM and DMARC Results in a Header?

Find the Authentication-Results line and look for spf, dkim and dmarc. A result of pass means the check succeeded. Fail, softfail or none means the sender could not be verified. Most importantly, check that the passing domain matches the From address, because that match is called alignment.

Here is what the common results mean:

• pass: The check succeeded and the server was allowed to send for that domain.
• fail: The sending server was not allowed. This is a strong warning.
• softfail: The server is probably not allowed, but the domain didn’t ask for a hard block. Treat it as suspicious.
• none or neutral: No usable record or signature was found, so nothing was verified.

Alignment is where many people get stuck. An attacker can pass SPF and DKIM using their own domain while showing yours in the From line. DMARC catches this by requiring the passing domain to match the visible From address. If you see dmarc=fail, the email is not from who it claims to be.

If you need a refresher on each protocol, read how SPF, DKIM and DMARC work together. If you own the domain being faked, our guide on how SPF, DKIM and DMARC protect your domain walks you through the fix.

Real vs Fake: A Header Example

Here is a simplified header from a fake “CEO” payment request. The company and domains are made up for this example.

Authentication-Results: mx.yourmail.ae;

  spf=fail smtp.mailfrom=mailer-9x.example;

  dkim=none;

  dmarc=fail header.from=alnoortrading.ae

Return-Path: <bounce@mailer-9x.example>

From: “Khalid Al Mansoori, CEO” <ceo@alnoortrading.ae>

Reply-To: <khalid.payments@mailbox-secure.example>

Subject: Urgent payment before 4pm

Received: from mailer-9x.example (203.0.113.45) by mx.yourmail.ae

Read it line by line. SPF fails because the server mailer-9x.example is not allowed to send for alnoortrading.ae. DKIM shows none, so there is no signature at all. DMARC fails because nothing lines up with the From domain.

Then check the other fields. The Return-Path uses a different domain. The Reply-To points to a third one. The only Received hop is an unknown server. That is five red flags in seven lines.

A real email from the same sender looks very different. SPF and DKIM both pass for alnoortrading.ae, DMARC passes, and the Return-Path matches the From domain. The Reply-To is either missing or uses the same domain.

Can a Fake Sender Still Pass the Header Checks?

Yes. An attacker can register a lookalike domain, set up valid SPF and DKIM for it, and pass every check. A hacked real account passes too. Authentication proves the domain is genuine, not that the sender is trustworthy, so always read the domain letter by letter.

Take our example again. The real domain is alnoortrading.ae. An attacker could register alnoor-trading.ae and set it up properly. The header would show spf=pass and dmarc=pass, but for the wrong domain. Only a careful look at the address gives it away.

The second case is a compromised account. If an attacker takes over your supplier’s real mailbox, the header will look perfect because the email truly came from their server. In this case the clues are in the content. Look for urgency, new bank details or a request to keep things quiet. Our guide to the signs your business email has been hacked covers what to watch for.

The best defence here is simple. Confirm any payment or bank detail change by phone, using a number you already have on file. Never use the number in the email.

What to Do When a Header Looks Wrong (and Why Manual Checks Aren’t Enough)

If a header looks suspicious, act quickly and calmly:

1. Don’t reply, click links or open attachments.
2. Send the full header or the original email to your IT team.
3. Confirm the request with the sender by phone on a known number.
4. Block the sender and report the email in your mail platform.

Reading headers is a good skill, but it doesn’t scale. Your team receives hundreds of emails a day, and nobody can inspect every one. Finance and admin staff are the usual targets, and attackers only need one message to slip through.

That’s why the real fix is automated protection. A good email security solution checks these header results for every message. It also catches lookalike domains and executive impersonation before they reach an inbox. Adding email sandboxing means links and attachments get tested in a safe space too.

Conclusion

Reading an email header is one of the fastest ways to catch a fake sender. Check whether Return-Path and Reply-To match the From address. Trace the Received lines from the bottom. Then read the SPF, DKIM and DMARC results in Authentication-Results.

Remember the limits. Lookalike domains and hacked accounts can still pass, so pair header checks with a phone call for anything involving money or sensitive data.

Your staff shouldn’t have to be header experts to stay safe. If you’d like to see how well your business is protected against spoofed and impersonation emails, book a free email security assessment. We’ll show you exactly where the gaps are.

Frequently Asked Questions