How to Check Where an Email Really Came From (Reading Email Headers)

By the MailGenerator Team · Updated November 8, 2026

The name and address you see at the top of an email are easy to fake. The email headers, a block of technical information attached to every message, are much harder to fake, and they record which servers actually handled it. You don't need to be technical to use them. Five minutes with this guide is enough to check whether that "urgent message from your bank" really came from your bank.

Step 1: Open the full headers

Gmail (web)

Open the email, click the three-dot menu next to the reply arrow, and choose Show original. A new tab opens with a summary at the top and the raw headers below.

Outlook

• Outlook on the web / new Outlook: open the email, click the three-dot menu, then View → View message details (or View message source).
• Classic Outlook for Windows: open the email in its own window, then File → Properties. The headers are in the Internet headers box.

Apple Mail (Mac)

Select the email, then choose View → Message → All Headers, or Raw Source for everything.

On a phone

Most mobile apps don't show headers. Open the same email in your provider's website on a computer instead.

Step 2: Check the three authentication results

Modern email uses three checks to prove a message came from the domain it claims. Gmail shows them in a neat summary at the top of "Show original". In other apps, look for a line that starts with Authentication-Results:.

• SPF (Sender Policy Framework) checks whether the server that sent the email is allowed to send mail for that domain.
• DKIM (DomainKeys Identified Mail) checks a digital signature added by the sending domain, proving the message wasn't altered and was signed by that domain.
• DMARC ties the two together and checks that the domain that passed SPF or DKIM matches the domain in the visible "From" address.

You'll see results like spf=pass, dkim=pass and dmarc=pass. For an email that claims to come from a big company, all three should pass, and the domains listed should belong to that company.

Step 3: Compare the domains

Passing isn't the whole story. Scammers can register a look-alike domain and set up SPF and DKIM perfectly for it. So check which domain passed:

• dkim=pass header.d=paypal.com on an email from PayPal: good sign.
• dkim=pass header.d=paypa1-alerts.net on an email from "PayPal": passed for the wrong domain. It's a fake.

Also compare these header fields:

• From: the address shown to you.
• Return-Path: where bounces go. For legitimate marketing email it's often a mailing service's domain, which is normal, but it shouldn't be a random unrelated domain for a message from your bank.
• Reply-To: where your reply would go. A classic scam trick is a convincing "From" with a "Reply-To" pointing to a free email account.

Step 4: Look at the "Received" path (optional)

Every server that handles an email adds a Received: line at the top, so you read them from the bottom up. The lowest one shows where the message started. You'll see server names and IP addresses. If an email claiming to be from a Canadian bank started on a server name that has nothing to do with the bank or its known email provider, be suspicious. This part takes practice, so lean on steps 2 and 3 first.

Red flags at a glance

• spf=fail, dkim=fail or dmarc=fail on a message from a well-known company
• Authentication passed, but for a domain that isn't the company's real one
• A Reply-To address on a free webmail service (Gmail, Outlook, Yahoo) for a "business" email
• Your provider's warning banner, such as "This message may be spoofed" or "Be careful with this message"

What headers can't tell you

Headers prove where a message came from, not whether the sender is honest. If a real account is hacked, emails from it will pass every check. And a legitimate company can send a misleading email. Combine header checks with the warning signs in our guide How to Spot a Phishing Email, and when in doubt, contact the company through its official website or app instead of replying.

Headers in a temporary inbox

When you use MailGenerator to receive a verification email, the same rules apply: a genuine verification message from a real service will be signed by that service's domain. If a "verification" email arrives that you didn't request, don't click its links.

Frequently asked questions

Can I see where the sender is located?

Sometimes roughly, from the IP address of the first server. But big providers like Gmail and Outlook hide the sender's own IP, so for most personal emails you'll only see the provider's servers.

Should I share headers with my IT team?

Yes. If you get a suspicious work email, forwarding it "as an attachment" or using your organisation's report button sends the headers along, which is exactly what security teams need.