Reading an email header like a postmark
October 12, 2026 · 2 min read
Every email carries a header: a block of lines above the message that most mail apps hide. It works a lot like the stamps and postmarks on a paper letter, and a few of its lines are worth knowing, especially when a message looks suspicious.
From: the line anyone can write
The From line has two parts: a display name and an address, for example "Your Bank" <[email protected]>. The display name is free text and can say anything at all. Always look at the address, and at the domain after the @ in particular.
Reply-To and Return-Path
- Reply-To is where your reply would go. When it points somewhere quite different from the From address, be careful.
- Return-Path is where bounce notices go. Newsletters often use a separate bounce address, so a mismatch alone is normal.
Received: the postmarks
Each server that handles a message adds a Received line at the top. Read them from the bottom up to follow the route from the first server to the last. The bottom lines can be faked by the sender, but the top ones were added by servers along the real path.
Authentication-Results: the quick verdict
Receiving servers usually summarise three checks in one line:
- SPF: was the sending server allowed to send for that domain?
- DKIM: does the message carry a valid signature from the domain, proving it was not altered?
- DMARC: do those results line up with the domain in the From line?
pass on all three is a good sign that the message really came from the domain it claims. A fail is a strong reason for caution.
Red flags worth a second look
- A familiar brand name in the display name with an unrelated domain in the address;
- lookalike domains with swapped or extra letters;
- urgency ("your account will be closed today") combined with a link to log in.
On MailPingBack the reader shows the sender address and the time each message arrived. To inspect full headers, use a mail client on an address you own.