Email Network Security Blog

How to Read Email Headers

An email header can tell you a lot about an email. It tells you the date it was composed and the sender of course, but it also can tell you the path it took to get to your mailbox. According to the internet standard which describes email body format, RFC-2822:

Header fields are lines composed of a field name, followed by a colon    (":"), followed by a field body, and terminated by CRLF.

The message header consists of fields, usually including at least the following:

• Return-path: This is the “envelope sender”. This is the address that a mail server will use in bouncing undeliverable mail.
• From: The e-mail address, and usually the friendly name of the sender. This is where an email client will reply to, generally.
• To: The e-mail address(es), and optionally the friendly name(s) of the message’s recipient(s).
• Subject: Added by the sender, this is a summary of the email.
• Date: The local time and date when the message was written.
• Received: These lines describe the path an email has taken on its way to you. This originates from the bottom-most Received line. To trace an email, you read the bottom one, then the next one up, then the next one up, etc., until you see it received by your email server at the top-most Received line.

Other common header fields include (see RFC 4021 or RFC 2076 for more):

• Cc: carbon copy
• Bcc: Blind Carbon Copy
• Content-Type: Information about how the message has to be displayed, usually a MIME type
• Reply-To: Address that should be used to reply to the sender.
• References: Message-ID of the message that this is a reply to, and the message-id of this message, etc.
• In-Reply-To: Message-ID of the message that this is a reply to.
• X-Face: Small icon.