Why does the From address in my inbox not match anything in the headers?

Mail clients sometimes show a display name instead of the raw address, and the visible From header itself is just a claim the sending software makes — it isn't verified by anything. Check Return-Path and the Received chain for a more reliable picture.

What's the difference between the From header and the Return-Path?

From is what the sender claims and what your inbox displays; it's trivially forgeable. Return-Path is where bounce messages get sent and often exposes the actual sending system, even when From looks legitimate.

Can I trust the Authentication-Results header?

It reflects what the receiving server decided at the time it processed the message, based on SPF, DKIM and DMARC — useful, but it's that one server's evaluation, not an independent, universally verified guarantee.

How to Read Email Headers

Every email carries metadata added by every server it passed through — invisible in a normal inbox view, but available through "show original" or "view source", and often more trustworthy than anything in the visible message.

What Email Headers Are

Headers are lines of metadata prepended to a message, oldest at the bottom, most recent at the top. Each mail server that handles a message adds its own lines rather than editing what's already there, which is what makes the header block a rough audit trail of the message's path.

The Received Chain

Read Received headers from the bottom up — the bottom one is the first hop, the top one the last server before your inbox. Each line names which server received the message from which other server, with a timestamp, letting you trace the actual path a message took and notice a hop that doesn't belong.

Authentication-Results

This header shows spf=pass/fail, dkim=pass/fail and dmarc=pass/fail as evaluated by the receiving server at the time it processed the message. It's a record of what that one server decided, not an independent guarantee — a different receiving server, or the same one at a different moment, can in principle reach a different result.

Other Useful Headers

Return-Path — where bounces are sent; often reveals the true sending system even when the visible From address looks fine
Message-ID — a unique identifier per message, useful for cross-referencing the same email across support tickets or logs
X-Mailer or User-Agent — the software that sent the message, when the sender includes it

How Headers Reveal Spoofing

The visible From address is trivially easy to forge — it's simply a claim the sending software makes. The Received chain and Return-Path are harder to fake convincingly, since real mail servers the message actually passed through added them; a mismatch between a plausible-looking From address and an implausible Return-Path or Received chain is a strong spoofing signal.

Analyze a Message's Headers

Analyze email headers →Next: Reading DMARC aggregate reports →

Try it on your domain

See the theory in practice — run a Email Header Analyzer for your own domain.