Email headers explained: the hidden record inside every message

Every email carries a block of technical text called the headers. Your mail app normally hides them and shows only the friendly parts — sender name, subject, date. The headers are where the real story lives.

Headers record:

• Received: lines — a stamped list of every mail server the message passed through, newest at the top.
• Message-ID — a unique identifier assigned by the originating system.
• From, Reply-To, Return-Path — the addresses the sender claims and the address bounces go back to.
• Authentication-Results — the receiving server's verdict on SPF, DKIM and DMARC.
• X-headers — extra fields added by mail software, spam filters and bulk-mailing platforms.

The body of an email can say anything a sender likes, but the headers are written by the machines that actually carried the message. That is why an Email Forensic Report is built from the headers and metadata rather than the words in the message. If you only forward us the visible text, the evidence is lost — the headers are the evidence.