Skip to content

Reading email headers

Every email carries hidden headers: a record of where it came from, which servers handled it, and whether it passed security checks. They help you trace delays, find out why a message went to spam, and spot fake (spoofed) emails. Our support team may ask you for them.

App Steps
Roundcube (cPanel webmail) Open the message, click More (⋯) → View source
Business Email webmail Open the message, open its menu → View message source
Gmail Open the message, click the three dots → Show original
Outlook (Windows) Double-click the message to open it, then File → Properties. Headers are in Internet headers
Outlook on the web Open the message, click the three dots → View → View message source
Apple Mail Open the message, then View → Message → All Headers

To send headers to support, copy the whole block and paste it into your ticket.

  • Authentication-Results: shows spf=, dkim= and dmarc= with pass or fail. Failures often explain why a message went to spam. See Fixing Gmail’s “couldn’t verify” warning.
  • Received: each server that handled the message adds a line. Read them from the bottom up to follow the message’s path, with times, so you can see where a delay happened.
  • Return-Path and From: if they belong to completely different domains, and the authentication checks fail, the message may be spoofed. See Email spoofing.
  • X-Spam-Status / X-Spam-Score: on our servers, shows SpamAssassin’s verdict and score.

Free tools such as Google’s Messageheader turn the raw headers into an easy-to-read summary.