Definition
Email headers are structured metadata fields at the beginning of every email message that document its journey from sender to recipient. While recipients typically see only the From, To, Subject, and Date fields, a complete header block contains dozens of fields including the originating IP address, authentication results, spam scores, and bounce codes. Reading raw headers is the primary method for diagnosing deliverability problems.
Headers are defined by the Internet Message Format standard (RFC 5322) and extended by numerous other RFCs. Each mail server that handles a message adds a Received header, creating a chain that traces the message's path. Headers also contain the results of authentication checks like SPF, DKIM, and DMARC, making them the definitive source for understanding why a message was filtered, bounced, or delivered to the spam folder.
How It Works
Every email message has two parts: the header and the body. Headers appear as lines at the top of the raw message source, each following the format Field-Name: value. Key diagnostic headers include Received (each server adds one), Authentication-Results (shows SPF/DKIM/DMARC pass/fail), Arc-Seal (for forwarded messages), and Feedback-Type (for bounce or abuse reports).
The Authentication-Results header is often the most valuable for deliverability diagnostics. It records the results of each authentication check performed by the receiving server, indicating whether the message passed SPF, DKIM, and DMARC alignment. A typical Authentication-Results header looks like: spf=pass smtp.mailfrom=example.com; dkim=pass header.d=example.com; dmarc=pass header.from=example.com. Bounce messages also contain specialized DSN headers that specify the bounce reason using SMTP status codes.
Best Practices
Always examine raw headers when investigating deliverability issues rather than relying on summary reports from your ESP. Look at the last Received header to see how the recipient's server initially accepted the message. Check the Authentication-Results header immediately to confirm all three authentication methods passed. Compare headers from messages that delivered successfully against those that went to spam to identify differences. Copy and paste headers into a header analysis tool like MXToolbox or Google's Messageheader for easier reading. Document the expected header patterns for your sending infrastructure so anomalies stand out quickly.
Related Glossary Terms
Bounce Classification
Bounce classification uses SMTP codes (550, 551, 552, 553, 554, 450, 451, 452) and enhanced status codes to categorise permanent and transient delivery failures.
DMARC Alignment
DMARC identifier alignment determines whether the domain in the From header matches the domains used in SPF and DKIM authentication. Strict or relaxed.
DMARC Policy Tags
DMARC DNS record tags including v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf, and ri control authentication policy, reporting, and alignment enforcement.
Email Active Subscriber
An active email subscriber has opened or clicked an email within a defined recency period, typically 30-90 days by industry. Active subscriber rate of 40-60% is typical for healthy email lists.
Email BIMI VMC
BIMI Verified Mark Certificate (VMC) certifies brand logo ownership for display in supporting email clients. VMCs cost £1,500-2,000+ per year per logo and require DMARC reject or quarantine policy plus SVG logo format.
Email Blacklist
An email blacklist (DNSBL) is a real-time database of IP addresses or domains known for sending spam or unwanted email.
Frequently Asked Questions
In Gmail, open the message, click the three-dot menu, and select "Show original." In Outlook, open the message and select File > Properties. In Apple Mail, open the message and select View > Message > Raw Source. Most email clients have a similar option in the message menu.
The Authentication-Results header is typically the most immediately useful because it shows whether your SPF, DKIM, and DMARC authentication passed or failed. The Received headers are also critical for tracing the delivery path and identifying where delays or rejections occurred.
When an email bounces, the server sends back a Delivery Status Notification (DSN) message. This message contains headers like `Diagnostic-Code` and `Status` that specify the SMTP bounce code (e.g., 5.1.1 for "user unknown") and a human-readable explanation of why the message was rejected.
Yes. Senders can forge some header fields like From and Subject. That is why SPF, DKIM, and DMARC were created to verify header authenticity. The Received headers added by trusted servers are more difficult to forge and provide a reliable trace of the message path.
Many email filtering systems add an X-Spam-Status header that contains the spam score and filtering decision for the message. It typically shows a numerical score, the threshold for spam classification, and the specific tests the message triggered.