Email Headers

The headers to read when a message looks like phishing — what's normal, what's a tell. Click any header to copy it.

Start here

Red flags at a glance

Any one of these earns a closer look; several together is your answer.

From ≠ Return-PathThe visible sender and the envelope sender (bounce address) are different domains — the classic forgery tell.
Reply-To ≠ FromReplies are steered to a different domain than the sender. The heart of most BEC.
SPF / DKIM / DMARC = failAny of the three failing (or "none"/"softfail") on a domain that should enforce them.
DKIM d= misalignedThe DKIM signing domain (d=) doesn't match the From domain — signed, but not by who it claims.
Look-alike sender domainHomoglyph or typosquat — paypa1.com, micros0ft.com, a Cyrillic "а".
Odd originating IP / geoA "bank" email from a residential or bulletproof-hosting IP, or a country that makes no sense.
Message-ID domain mismatchThe Message-ID domain doesn't match From, or the ID is malformed / reused.
Received chain gapsMissing hops, big time jumps, or private IPs where public ones belong — a forged path.
Display-name spoofThe name says "IT Support" or a real person; the actual address doesn't match.
Bulk mailer on a "personal" noteX-Mailer shows PHPMailer or a mass-mailing kit behind a one-to-one message.

Core

Identity & routing

FromRFC 5322 The author, as displayed. Trivially spoofable — check it against Return-Path, Message-ID, and the auth results.
Return-PathRFC 5321 The envelope sender (where bounces go). A mismatch with From is a top forgery signal.
Reply-ToRFC 5322 Where replies are sent. A different domain than From is the BEC redirect.
SenderRFC 5322 Who actually submitted it when that isn't the From author. Worth noting on "on behalf of" mail.
To · CcRFC 5322 Recipients. "undisclosed-recipients" or you sitting in Bcc points to a mass send.
DateRFC 5322 When it was composed. Should track the Received timestamps — a big gap is suspicious.
ReceivedRFC 5321 One line per hop, bottom-up. The routing spine — read the originating IP, the HELO name, and the timestamps for forged or missing hops.
Received-SPFRFC 7208 The receiver's recorded SPF result and the IP it checked. pass / fail / softfail / neutral.
Message-IDRFC 5322 Unique per message, usually <random@sending-domain>. A domain that doesn't match From, or a malformed / reused ID, is a flag.
X-Originating-IPNon-standard. When present, the original client IP — geolocate it and compare to the claimed sender.
Delivered-ToNon-standard. The final mailbox. Useful for confirming the real recipient behind aliases.

The verdict

Authentication — SPF / DKIM / DMARC / ARC

This is where the receiving server tells you whether the sender is who they claim. Read it first.

Authentication-ResultsRFC 8601 The summary verdict — look for spf=, dkim=, dmarc=. pass is good; fail / softfail / none is the story.
SPFRFC 7208 Was the sending IP authorized to send for the envelope domain? Checks Return-Path, not From — so it can pass on a spoof.
DKIM-SignatureRFC 6376 Cryptographic signature. Read d= (signing domain) and s= (selector) — d= should align with From.
DMARCRFC 7489 Ties SPF/DKIM to the From domain (alignment) and states policy: p=none / quarantine / reject. A pass here is the strongest signal.
ARC-Seal · ARC-Message-SignatureRFC 8617 Preserves the original auth results across forwarders and mailing lists that would otherwise break SPF/DKIM.

Message body

Content & client

SubjectRFC 5322 The lure. Watch encoded-word form (=?UTF-8?B?…?=) hiding the real text or slipping in look-alike characters.
MIME-Version · Content-TypeRFC 2045 Structure and parts. Note HTML-only bodies, odd multipart boundaries, and attachment types.
Content-Transfer-EncodingRFC 2045 base64 / quoted-printable can obscure body content and payloads from a quick read.
X-Mailer · User-AgentNon-standard. The sending client. PHPMailer, mass-mailer kits, or a mismatch with the claimed sender are tells.
X-Priority · ImportanceNon-standard. Forced "High" priority is a cheap urgency lure — weigh it with everything else.
List-UnsubscribeRFC 2369 Legit bulk mail carries it; check the target — a malicious or mismatched URL here is a flag.

Vendor X-headers

Gateway & anti-spam

Non-standard, but your mail security stack writes its verdict here. Values vary by vendor.

X-Forefront-Antispam-ReportMicrosoft 365. Carries SCL (spam confidence), CAT (category), SFV (filter verdict), and the sender IP.
X-Microsoft-AntispamMicrosoft 365. Includes BCL (bulk complaint level) — higher means more bulk-like.
X-MS-Exchange-Organization-SCLMicrosoft. Spam Confidence Level, roughly -1 (safe) to 9 (certain spam).
X-Spam-Status · X-Spam-ScoreSpamAssassin. The verdict, score, and which rules fired.
X-Sender-IP · X-SenderScoreThe connecting IP and its sender reputation score, when the gateway records it.
X-Proofpoint-* · X-Mimecast-*Third-party gateways. Vendor-specific spam / URL-rewrite and verdict headers.

Reference

Every header field & its RFC

The complete, authoritative list lives in the IANA Message Headers registry — every registered field name, its status, and the RFC that defines it. When you hit a header not covered here, look it up there.

iana.org/assignments/message-headers →

Core RFCCovers
RFC 5322Internet Message Format — From, To, Date, Subject, Message-ID, Received…
RFC 5321SMTP — envelope, Return-Path, Received trace
RFC 4021Registration of mail & MIME header fields
RFC 2045–2047MIME — Content-Type, encodings, encoded words
Auth RFCCovers
RFC 7208SPF
RFC 6376DKIM
RFC 7489DMARC
RFC 8601Authentication-Results header
RFC 8617ARC (forwarded-mail auth)