What Are Email Headers? Received, Authentication-Results, X-

Email headers are the lines of metadata at the top of every message, above the body, that describe who wrote it, where it went, which servers handled it and what checks it passed. Some headers such as From, To, Subject and Date are shown by every mail app. Most, including Received, authentication (proof that email really comes from your company)-Results and the X- headers, are hidden but are exactly what you need when a message is delayed, marked as spam or suspected of being fake.

Quick summary

• From, To, Cc, Subject, Date: the author-supplied basics. From can be forged, which is why the next ones exist.
• Message-ID: a unique identifier for the message, used for tracing and threading.
• Received: one line per server that handled the message, newest at the top. Each shows from, by, with (protocol) and a timestamp.
• Return-Path: the envelope sender, where bounces go, added by the final receiving server.
• DKIM-Signature: the cryptographic signature with d= (domain) and s= (selector).

The headers you will actually use

• From, To, Cc, Subject, Date: the author-supplied basics. From can be forged, which is why the next ones exist.
• Message-ID: a unique identifier for the message, used for tracing and threading.
• Received: one line per server that handled the message, newest at the top. Each shows from, by, with (protocol) and a timestamp.
• Return-Path: the envelope sender, where bounces go, added by the final receiving server.
• DKIM-Signature: the cryptographic signature with d= (domain) and s= (selector).
• authentication (proof that email really comes from your company)-Results: the verdict of the receiving server for SPF, DKIM, DMARC and sometimes ARC.
• List-Unsubscribe and List-Unsubscribe-Post: how bulk mail offers one-click unsubscribe.
• X- headers: non-standard, added by any software: X-Mailer, X-Spam-Status, X-Originating-IP, X-Priority.

Example: a real header block, trimmed

Return-Path: <sales@yourdomain.com>
Received: from mail.oqumail.com (mail.oqumail.com [203.0.113.10])
        by mx.google.com with ESMTPS id x12si345
        for <buyer@gmail.com>; Sun, 12 Jul 2026 09:15:40 -0700 (PDT)
Authentication-Results: mx.google.com;
       dkim=pass header.i=@yourdomain.com header.s=oqumail;
       spf=pass (google.com: domain of sales@yourdomain.com designates 203.0.113.10 as permitted sender) smtp.mailfrom=sales@yourdomain.com;
       dmarc=pass (p=NONE) header.from=yourdomain.com
DKIM-Signature: v=1; a=rsa-sha256; d=yourdomain.com; s=oqumail; ...
Message-ID: <b7e4d2a0@mail.oqumail.com>
From: Acme Sales <sales@yourdomain.com>
Subject: Your quote

How to view full headers

1. Gmail: open the message, three dots, Show original. The summary at the top decodes SPF, DKIM and DMARC for you.
2. Outlook desktop: open the message, File, Properties, Internet headers.
3. Outlook on the web: three dots, View, View message details.
4. Apple Mail: View, Message, All Headers.
5. Paste the block into Google Admin Toolbox Messageheader or the MXToolbox header analyzer to get a hop-by-hop timeline.

Reading Received headers for delays

Read Received lines from the bottom up: the bottom one is the first server that accepted the message, the top one is the last. Compare timestamps between neighbouring lines. A gap of several minutes between two hops shows where the message waited, usually in a queue at the sender or in greylisting at the receiver. The from and by names tell you which organisation owns that hop.

Common mistakes when reading headers

• Trusting the From line or a Received line that a spammer inserted. Only the Received lines added by servers you trust, and the authentication (proof that email really comes from your company)-Results from your own receiver, are reliable.
• Ignoring header.from and SMTP (the standard way computers hand off outgoing email).mailfrom in authentication (proof that email really comes from your company)-Results, which tell you which domain each check evaluated.
• Reading an old authentication (proof that email really comes from your company)-Results left by a forwarder as if it were your own server verdict. Check the hostname after the header name.
• Assuming an X-Spam-Status header is authoritative. It reflects one filter at one hop.

Headers and OquMail

Every message sent from OquMail carries a DKIM-Signature for your domain and leaves with an envelope sender on your domain, so the Authentication-Results at Gmail, Outlook or Yahoo should read pass three times. If a recipient reports spam placement, ask them for the header block; combined with the delivery log in your OquMail dashboard, which records the remote response for that message, you can see whether the problem was authentication, reputation or content.

Common questions

Can email headers be faked?

Any header the sender writes can be faked, including From and early Received lines. Headers added by the receiving server, especially authentication (proof that email really comes from your company)-Results, cannot be forged by the sender.

Which header shows the sender IP?

The bottom-most trustworthy Received line shows the IP that connected to the first server. Some webmail providers hide the user IP and show only their own server.

Why are there several Authentication-Results headers?

Each receiving hop may add its own. Read the one whose hostname belongs to the final recipient provider.