How to Read Email Headers (Gmail, Outlook & Apple Mail)

How to open the full headers

• Gmail (web): open the message, click the three-dot menu next to Reply, choose Show original. Gmail shows an SPF/DKIM/DMARC summary at the top and the raw headers below.
• Outlook on the web and new Outlook: open the message, click the three-dot menu → View → View message details.
• Classic Outlook for Windows: open the message in its own window, then File → Properties; the headers are in the Internet headers box.
• Apple Mail (Mac): select the message, then View → Message → All Headers (Shift-Command-H), or Raw Source (Option-Command-U) for everything.
• Thunderbird: View → Headers → All, or View → Message Source (Ctrl+U).
• iPhone and Android mail apps generally cannot show full headers — use webmail or a desktop client.

The Received chain: read it bottom to top

Each server that handles a message adds a Received: header at the top, so the oldest hop is at the bottom and the final delivery is at the top. A typical line: Received: from mail.sender.com (mail.sender.com [203.0.113.10]) by mx.google.com with ESMTPS id … for <you@gmail.com>; Tue, 27 Oct 2026 09:14:02 +0000

The from part names the server that handed the message over and its IP address in brackets; the by part names the server that received it. with ESMTPS means the hop was encrypted with TLS; plain SMTP or ESMTP means it was not.

To diagnose delays, compare the timestamps between consecutive Received lines (allowing for time zones). A gap of hours between two hops shows exactly where the message sat. To find the real sending server, look for the first Received line added by the recipient’s provider — everything below it was written by servers outside their control and can be forged.

Authentication-Results: the verdict line

The receiving provider records its checks in Authentication-Results. A healthy example: Authentication-Results: mx.google.com; dkim=pass header.i=@yourdomain.com header.s=mail; spf=pass (google.com: domain of bounce@yourdomain.com designates 203.0.113.10 as permitted sender) smtp.mailfrom=bounce@yourdomain.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=yourdomain.com

• spf= — pass, fail, softfail, neutral, none, temperror or permerror. smtp.mailfrom shows the domain SPF checked (the Return-Path).
• dkim= — pass, fail, none, or neutral. header.i or header.d shows the signing domain and header.s the selector.
• dmarc= — pass or fail. header.from is the visible From: domain being protected; p= echoes your published policy and dis= shows what the receiver actually did (NONE, QUARANTINE or REJECT).
• Microsoft adds similar data in Authentication-Results plus X-MS-Exchange-Organization-SCL (spam confidence level, 0–9; 5 or more usually means junk) and X-Forefront-Antispam-Report.
• Received-SPF: is an older single-line SPF result some servers still add.
• ARC-Authentication-Results and ARC-Seal appear when a mailing list or forwarder re-sent the message and recorded the original results.

From, Return-Path, Reply-To and Sender

These are easy to confuse, and phishing often exploits the difference:

• From: — the address the recipient sees. DMARC protects this domain.
• Return-Path: — the envelope sender, where bounces go. SPF checks this domain. Newsletter platforms often set it to their own domain, which is why SPF can pass but not align for DMARC.
• Reply-To: — where replies go if set. A From: of your bank with a Reply-To: of a random free-mail address is a classic phishing sign.
• Sender: — the actual sending agent when it differs from From:, such as an assistant sending on someone’s behalf.

Message-ID, Date and other useful lines

• Message-ID: — a unique identifier like <abc123@mail.yourdomain.com>, generated by the sending system. Useful when asking a provider to trace a message, and its domain part often reveals which system sent it.
• Date: — set by the sender’s client, so it can be wrong; Received timestamps are more trustworthy.
• DKIM-Signature: — shows d= (signing domain) and s= (selector) so you can look up the key.
• List-Unsubscribe: and List-Unsubscribe-Post: — present on bulk mail; the latter enables one-click unsubscribe.
• X- headers — non-standard, added by individual systems (spam scores, mailer names, tracking IDs). Helpful hints, but not standardised.

Putting it together: a quick diagnosis routine

For a message in spam: check Authentication-Results first. Any fail means fix your DNS; look up your records with a DNS checker. If all pass, the problem is reputation or content. For a suspected phishing email: compare From:, Return-Path: and Reply-To:, then look at dmarc= — a fail on a well-known brand’s domain is a strong warning. For a delayed message: walk the Received chain and find the biggest time gap.

When you contact support at any mail provider, including HavitoMail, paste the full headers rather than a screenshot of the message. They contain the Message-ID and server timestamps needed to trace exactly what happened.