What is an email header?
An email header contains technical information describing how a message was sent. In addition to visible information such as sender, recipient and subject, it can contain routing and authentication details.
From and Reply-To fields
The From field identifies the visible sender. A Reply-To field can direct responses to another address. In suspicious messages, unexpected differences between these fields may require additional investigation.
Received lines
An email can pass through several mail servers before delivery. Each server may add a Received line to the header, creating a record of the path followed by the message.
SPF, DKIM and DMARC results
Fields such as Authentication-Results may show SPF, DKIM and DMARC validation. A PASS result indicates successful validation, while a FAIL result can require closer examination.
Why is Message-ID useful?
Message-ID is normally a unique identifier generated for a message. Administrators can use it to locate a specific email in server logs when investigating delivery problems.
Using headers for fraud analysis
The visible sender address alone does not prove the true origin of an email. Technical header information should be evaluated together with mail server logs and domain authentication data.