Email Headers Made Easy - How To Read and Understand Them - ICDSoft (2024)

• What are email headers?
• How to find the email headers?
• Which are the most important headers of an email?
• Reading and understanding the email headers
• In Conclusion

What are email headers?

Email headers contain valuable information about the path of the message from its initial sender to the final recipient. This includes IP addresses, server names, authentication data, originating entity to mention a few. This part of the email is usually hidden and can be analyzed by viewing the source code of the message. The email headers, however, could be modified by every server along the route and could be altered even upon sending due to a flaw in the global email system itself.

For example, in the so-called spoofing attacks, the sender forges certain email headers in an attempt to trick the recipients of the message that the spoofed message originates from a legitimate source - their bank, a service provider, a popular website, etc. In such attacks, scammers take advantage of the flaws of the global email system to create a false sense of trust and deceive their victims so steal sensitive data, e.g. credit card information, website login credentials, mail passwords, etc.

How to find the email headers?

Most email clients (desktop programs and web-based solutions) have the option to display the full headers of an email.

We have published instructions for viewing the full email headers in some of the most popular email clients, such as Outlook, Thunderbird, Mail for Mac, Windows Mail, Gmail, Hotmail.com/Outlook.com/Live.com, Yahoo Mail, etc. at the ICDSoft Knowledge Base:

Viewing e-mail message headers

Which are the most important headers of an email?

Reading email headers is usually done for two reasons - checking if the email is legitimate or finding its real sender. By analyzing the email headers, you can also find when the message was sent, and how long it took for it to be delivered. You can also find if you received it directly or as a forwarded message. Some of the most important headers are:

• From: name and email address of the sender
• To: name and email address of the recipient
• Date: time and date when the message was sent, including the timezone of the sending system
• Subject: shows the topic of the message
• Return-Path: the email address to which a message can be returned in case it is not successfully delivered, e.g. in case of a server error, insufficient space, non-existent mailbox, etc.
• Reply-To: the email address to which a recipient will respond if they decide to reply back to a message
• Received: lists all mail servers through which a message has gone prior to arriving at its final destination; a message usually has more than one Received headers, and the first one shows the original sending server.
• Delivered-To: shows the email address to which a received email was delivered; one message could have multiple Delivered-To headers due to email forwarding
• DKIM-Signature: this is the text value of the DKIM record added to the message to allow validation
• Received-SPF: an advisory header showing whether the IP address through which the message was sent is designated as a permitted sender
• Authentication-Results: shows whether SPF, DKIM, and DMARC checks pass or not
• Message-ID: a unique combination of letters and numbers that identifies each message; this globally-unique identifier can be used to distinguish one message from other emails
• User-Agent or X-Mailer: shows the name of the email program used for sending the message
• MIME-Version: Multipurpose Internet Mail Extensions (MIME) is an internet standard of encoding, which converts non-text content (images, videos, and other attachments) into text, so they can be attached to an email and sent via SMTP
• X-Originating-IP: shows the IP address of the original sender; this header is not always present, so you may have to look for the first Received header instead.

Reading and understanding the email headers

Let's dissect a few emails and their email headers.

Received: from CPWPR80MB6141.lamprd80.prod.outlook.com (2603:10d6:103:10f::10) by SCZPR80MB6981.lamprd80.prod.outlook.com with HTTPS; Mon, 10 Apr 2023 20:38:29 +0000Received: from DS7PR03CA0238.namprd03.prod.outlook.com (2603:10b6:5:3ba::33) by CPWPR80MB6141.lamprd80.prod.outlook.com (2603:10d6:103:10f::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.34; Mon, 10 Apr 2023 20:38:27 +0000Received: from DM6NAM10FT094.eop-nam10.prod.protection.outlook.com (2603:10b6:5:3ba:cafe::26) by DS7PR03CA0238.outlook.office365.com (2603:10b6:5:3ba::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6277.36 via Frontend Transport; Mon, 10 Apr 2023 20:38:26 +0000Authentication-Results: spf=pass (sender IP is 192.252.146.28) smtp.mailfrom=icdtest.net; dkim=pass (signature was verified) header.d=icdtest.net;dmarc=bestguesspass action=none header.from=icdtest.net;compauth=pass reason=109Received-SPF: Pass (protection.outlook.com: domain of icdtest.net designates 192.252.146.28 as permitted sender) receiver=protection.outlook.com; client-ip=192.252.146.28; helo=s466.sureserver.com; pr=CReceived: from s466.sureserver.com (192.252.146.28) by DM6NAM10FT094.mail.protection.outlook.com (10.13.153.58) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6298.26 via Frontend Transport; Mon, 10 Apr 2023 20:38:26 +0000X-IncomingTopHeaderMarker: OriginalChecksum:297C7E56DB8DA6E6AC3DB36FDFECEAF23A80446DD23588094814949752EC5A1E;UpperCasedChecksum:FF301AF182321DCE2B20470C944DE12327C269E3E917E3EA6E2B9F88FB3CE6BB;SizeAsReceived:1059;Count:13DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=icdtest.net; h=message-id:date:mime-version:to:from:subject:content-type:content-transfer-encoding; s=dkim; bh=fdkeB/A0FkbVP2k4J4pNPoeWH6vqBm9+b0C3OY87Cw8=; b=ibNFtfV9TDB2T9WLkpQgr7Cz+nnjLhALlKhp9t1U2q/6KbP8Gyr0C1Kjngkzdfsfa*gtSRlgX9iMeMaqYbyIUbMdePSr0t8cp/DqCkVKOHfDTUgqxjt4xU/M8d41n3z1fMZna8PXTeDmtyKPobwdNEqUuCWBvh+KTsdwZ5EPMAWs=Received: (qmail 54628 invoked by uid 1003); 10 Apr 2023 20:38:25 -0000Received: from unknown (HELO ?213.145.98.191?) ([emailprotected]@213.145.98.191) by s466.sureserver.com with ESMTPA; 10 Apr 2023 20:38:25 -0000Message-ID: <[emailprotected]>Date: Mon, 10 Apr 2023 23:38:22 +0300User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.6.1Content-Language: bg, en-USTo: [emailprotected]From: John Smith ICDSoft <[emailprotected]>Subject: TestContent-Type: text/plain; charset=UTF-8; format=flowedContent-Transfer-Encoding: 7bitX-IncomingHeaderCount: 13Return-Path: [emailprotected]X-MS-Exchange-Organization-ExpirationStartTime: 10 Apr 2023 20:38:26.3714 (UTC)X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmitX-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmitX-MS-Exchange-Organization-Network-Message-Id: e510d1e0-8d30-4dd0-b95c-08db3a03892bX-EOPAttributedMessage: 0X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0X-MS-Exchange-Organization-MessageDirectionality: IncomingX-MS-PublicTrafficType: EmailX-MS-TrafficTypeDiagnostic: DM6NAM10FT094:EE_|CPWPR80MB6141:EE_|SCZPR80MB6981:EE_X-MS-Exchange-Organization-AuthSource: DM6NAM10FT094.eop-nam10.prod.protection.outlook.comX-MS-Exchange-Organization-AuthAs: AnonymousX-MS-Office365-Filtering-Correlation-Id: e510d1e0-8d30-4dd0-b95c-08db3a03892bX-MS-Exchange-EOPDirect: trueX-Sender-IP: 192.252.146.28X-SID-PRA: [emailprotected]X-SID-Result: PASSX-MS-Exchange-Organization-SCL: 1X-Microsoft-Antispam: BCL:0;X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Apr 2023 20:38:26.1995 (UTC)X-MS-Exchange-CrossTenant-Network-Message-Id: e510d1e0-8d30-4dd0-b95c-08db3a03892bX-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaaX-MS-Exchange-CrossTenant-AuthSource: DM6NAM10FT094.eop-nam10.prod.protection.outlook.comX-MS-Exchange-CrossTenant-AuthAs: AnonymousX-MS-Exchange-CrossTenant-FromEntityHeader: InternetX-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000X-MS-Exchange-Transport-CrossTenantHeadersStamped: CPWPR80MB6141X-MS-Exchange-Transport-EndToEndLatency: 00:00:03.0105348X-MS-Exchange-Processed-By-BccFoldering: 15.20.6277.038X-Microsoft-Antispam-Mailbox-Delivery:abwl:0;wl:0;pcwl:0;kl:0;dwl:0;dkl:0;rwl:0;ucf:0;jmr:0;ex:0;auth:1;dest:I;ENG:(5062000305)(90000117)(90012020)(91020020)(91040095)(9050020)(9100338)(2008001134)(4810010)(4910033)(8820095)(9575002)(10195002)(9320005);X-Message-Info:qZelhIiYnPkx84CNH6AeQs2r1mfbx475RiI5K0+Xb2fvrntBfTJ10N2zNIvcvtf7VgXmo/rIiDQIXO6S3rtSdn/H4xrzDv+I2RFpBW+pxB4yhwf8VqBxAb2oTJ+jKAPjknpLKx0rGhWF/Oowozp6RA==X-Message-Delivery: Vj0xLjE7dXM9MDtsPTA7YT0wO0Q9MTtHRD0xO1NDTD0zX-Microsoft-Antispam-Message-Info:2XW49YUfX7Ef7WxmE6wjxj/fif+7fGH+twWXcfxQtR1vkKoi4TjYoV1cO+qhBcvp1abvYKtlHlmCQF0GP91JLj+JBe1smkhgc7MbdZnC61tH+tK8px9bwLvfV7+VA3tXaSid7Z399I1Cse4j5wGp/y6Q1UiBTB9I2WOWnXTD5+p6T4ih4Nj+IdT+qn7bEwtACvEqwT4MwMUXWE+9fSgWKULnwirt1jSJ4FcCLshMUYi5oo4+2J/QiKtAa5LgXiINr9RYkNlPQZr2wMm6Y9jOSDOSpBFXskFYA53Vz91nHIIJ2tjCSsnlEhom*oxzdNqGafUWqDexnwzEgKcw8riXh/V1g3Qpsm0aJn5Cw01BVdpZkI38fi1I36ymThNRZCzRTPLJlIzdd3eiWBi8qYFWS2DIlp1eLsMebuUP2U89bB9MedvQqpxTTn3Vn/qXl4RTEPBfo+Jl6Mht8yGrS+Sw8CrMhf8M8H9d6Q3uRsP0MqLxRm4yKNMNDdVB2LOXuzZ1tm1wdmPE2jejJxp2dcZfBRwaio/xNvKWFGHRGFHCkMXACrSMkC38UoguA4sVm1CyCiI7QuyPMbhqpXbTyM1vbRWQ4tGhcxnM995gwQ6S5oF7SovLiNlD4Mm0Wnf5z2R+WUFJxyRKrb2Kng+AbDGcAYrsV506J8dBL5kQDhOQC7ASlsUMKD5iQn//dTpUMI/0eJJniDQTNG45mPBQ0RUErwTN+CxLMHruIZyRiVPjWfqaqM2XnBctXIOsEEnnowIuyJpyndbpawHoA2IEk6SmJDRThlZsx2EzJrBDx5KA91hO5G4DDCDpYyL6o0yutK6nVFlJVbtns7q8XAFzEa5ENiQ==MIME-Version: 1.0

The main headers show some basic information:

• From: John Smith ICDSoft <[emailprotected]>
• To: [emailprotected]
• Subject: Test
• Date: Mon, 10 Apr 2023 23:38:22 +0300
• Return-Path: [emailprotected]

We can find interesting information about this message from some additional email headers:

• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.6.1

  The message was sent via the email program called "Mozilla Thunderbird"

• Received: from unknown (HELO ?213.145.98.191?) ([emailprotected]@213.145.98.191) by s466.sureserver.com with ESMTPA; 10 Apr 2023 20:38:25 -0000

  The message originates from s466.sureserver.com and was sent using SMTP authentication through mailbox [emailprotected] from a device with IP address 213.145.98.191

• Received: from s466.sureserver.com (192.252.146.28) by DM6NAM10FT094.mail.protection.outlook.com (10.13.153.58) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6298.26 via Frontend Transport; Mon, 10 Apr 2023 20:38:26 +0000

  The IP address of the sending mail server is 192.252.146.28

• Authentication-Results: spf=pass (sender IP is 192.252.146.28) smtp.mailfrom=icdtest.net; dkim=pass (signature was verified) header.d=icdtest.net;dmarc=bestguesspass action=none header.from=icdtest.net;compauth=pass reason=109

  The SPF and DKIM checks passed, and the message has been verified as legitimate. The part "dmarc=bestguesspass action=none" means that the message is authenticated, but the matching authenticated domain is missing a DMARC record. Authenticated messages which pass the SPF/DKIM checks and have SPF, DKIM, and DMARC records would have "dmarc=pass action=none" instead (if the DMARC entry is using the "none" policy). Spam emails would have something like "dmarc=fail action=quarantine" (if the DMARC entry is using the "quarantine" policy).

Here is another example - a message sent from [emailprotected] to [emailprotected], and then forwarded to [emailprotected]:

Received: from 10.197.34.204 by atlas116.free.mail.bf1.yahoo.com pod-id NONE with HTTPS; Fri, 28 Apr 2023 15:12:41 +0000Return-Path: <SRS1-LNPzUwy8=s466.sureserver.com=-dYsHhaIs=AT=icdtest.net=johnsmith@s807.sureserver.com>X-Originating-Ip: [195.8.222.25]Received-SPF: pass (domain of s807.sureserver.com designates 195.8.222.25 as permitted sender)Authentication-Results: atlas116.free.mail.bf1.yahoo.com; dkim=perm_fail [emailprotected] header.s=dkim; dkim=pass [emailprotected] header.s=dkim; spf=pass smtp.mailfrom=s807.sureserver.com; dmarc=pass(p=QUARANTINE) header.from=icdtest.net;X-Apparently-To: [emailprotected]; Fri, 28 Apr 2023 15:12:41 +0000X-YMailAVSC: lF3DrzU3bBu0FPN6dthhAHxeo9QUblJEBPOplMaK4eHqTNQ hXElN1TqInUx5XNgKv1R5J57VSg.5z5OP5Jm7n824cXEA9bHYs07gSt11sTH qf2OO34xrz03_Ry2vl8nOdQd84K8ZO03UBcfIEX4QsV7VdgbSDaMeIwMNSvR _dhveNFa0gqual8NoElmRv5F2ykyx_dziMmje_xv7_persOxcqHL12q3gAF8 Vo9nZJ6I2H1nldPiS0wZa3szvxi8.MDMrJ41ft5bPIXiaag4crF.R4mvWrQ0 4_xh2EbgQ5Y5wqroXM9rn.KPlS_6omJ0lOpMTRB2K9FrTOxEq2mSTz7ZYomN 7O2L0ZvymvmeDl5VWjbVfDIO8Uig_1Cx1z24bCebm6nVfszuqfTKmUViz3Yu eyAFFBO4vXQ0PCq3RTTkKIui2J.MaXkhdf_amcruR07oqU8_tgHKZ1Ypldet ECgsvdp4wWXziyxn7.kZUF0wB7dHdURUKBa18YVOr56l05lDJLengpb3FB4t GGceVeaPzW9nz3SOMBtiRBGixCIVkdt5ncmw6gq0BQ5v0CqKU57XDxSBk_RN K36vfIobf1qKsjNGzRX0JTEOnvssqxw9ysxyPR5jQZmZ2mPKN06dP05jhVKu LxLT5jg469NNVnw2cvVaxJqEhEwbYQE6QMdYDfkolqerWqWv8pmEVA9VineX Dm3SIwYjh5IvfGdzDdrOMowDooQfyi2xayCKIVop7EHa0.9dYmqG95Q.tg0n pT7SY6cgM8dL14DAORl7NXGLviMXO6KPiOeKMkfK_.CQjO9O2BR5XNyCvWZl uZs0_Vk4rmKEyFGpoIN_Jp2un.my4J6YqjMz3tW10Ixp9G0xEoDC9G7H0sFF 3AQ1HkzEu3Xb79gpErBn6YyACXyjKbd9dDUiKX1zfk115Jf58zVdkiMmid0A jEc.cGdUgRemH6ei6o7XVFH54B7sLvPvKY7.B1EMO_QSqgpMxKo5ERRFsqRm yFxMaCM2aECQeSOq_rUXQDizzVXQiK4z2AD.Okt.40jZ4sD8dUktUZIr2EIo C.fVVoAtQq4wYPgoobQZgldwnfsVDgJOAq5QQbabj7ovBGLRoRfaeHUVfs8Q c6yiFb5nTgh_GwPmvd.9Kdp5m5rUuVqTjq_t0SB94gC7PfOvuLTimSVaQ_WA fDoTEpUu07RMSIwtwvoyYhGRP7vcr9O4mUt5qYhVsG4EItA--X-YMailISG: 4az9ipwWLDsebazowrhLLkN2KLfEgrpylAoDv0Cd37ObwwjK RMwMg3YDSz.6_m5b4n9TMm5liTJB8bk.yi56t446kr2H5lxjWT7FBOzSx6Ur zGezZuDbXHf2B1l7gDz.X1ty9SoPcm637vrBHcKnSkktGfRsocaSKcLKAxqu sP1K.TIHSHLqLZLdwP626GLbywnzLw0vYel.eW55jaAwo7.dG6pSnKgHHMuw VCGno3yiEVhyESX7s4IuYCQBTmRGSsWoKQUdMQOxsOuOH9L9POKXk2.9voTc VPrFttkSl7.wTsWEiQ5uChgLG1Xm.0cd1e3ea_LbDKoe.PQuqKTAyW6wFrJ2 KCu6CYIAsX8fmQADrvDhFAXE3fqTwH_oxh2byb03sXr315yeMDU79B9FWExn EqLCT7aJFegmFhLpWzyBIyBF.iwJeObspLDN8IQLbIsZv1lbAx8rJblYV2z1 hqvuiaE9w7HUo5tfFIYS3H5KexsygT.jfCqryDSqAdro6HXLvQriyzNyisjd kBEQ99wFLsMHamg.yoKTaqhh.aqJQZehFwZX07v9fzF5w.bnaK._Kiiuwwk9 S3v.RXdmHd4uRVKC2JyRcauDodXE7WSxiA6EYcxcUa3zO.iDyAIgAy2UuDPN g5rLHtyIb19Fza812pUDO6Vt1b2_k2vyhoBysNsq29b8yKz5eMlr7Mt2aWT_ h8YrNRUPa8BEkA3uXdVJ3DqTBzX0nHRiFwkdFGSdZaq0NZf8bZg4Y._2rdu1 1hHWkGoMk3n1sInrKsKQgGZUz1_Ut5nldr6hsSaFGEshSIN0o3_gSUNUv6sn zp88QvNnoB2ANToUs2hB2KSPKx53CPuHRWhIz2LDPul.SOj9jE2AUY.KGU17 ImxGpQKd6WPzU_ue9hK9.qIh5k..ESZyx4wOGi._6IsNTOQ42T7WybDNdTRP 8s1rjOjP8ZibzHeLniMMxo8FhykqRMOGCd5EQD.Ced0Mq8djFxOw4YkkauIW oybO68ytasCmX_olsBOKykV6enAnqFZsPKBQi3_XBIlpghqV8geLjarLt4S2 0sLzlYWx0AdgxN6UE60KXpJwFgQfUoBMOeDq.hbZ66h6TLLmHpUPXLoQDoUe W7xucUhLK4buh927.rzLwFsYt10C.WBdsjYUINTniReUWMCLyb_jpsbr02v4 jvOY1m3ZRmVPAkkXi3T.B4D3fl8DF7nKCurgk_zk6a..tUi0GvqgGW2cEE1G 92KdkJAimPxk9K1P269dA_FzFklD16TI8yMQhFAKVOzl1v4aWWlW8QLW9uZ8 M2.ZReceived: from 195.8.222.25 (EHLO s807.sureserver.com) by 10.197.34.204 with SMTPs (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256); Fri, 28 Apr 2023 15:12:41 +0000DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=icdtest.net; h=message-id:date:mime-version:from:subject:to:content-type:content-transfer-encoding; s=dkim; bh=a+6z9N9M4Z1sFKIixisE8eG5osnzDYVSQob1aq6RKk8=; b=AO4HL7+LxttUHcalSW9vTkbWz3bzefdJRUO9Wzzhvss9XXmkk3WwuaB7iSwzHflyIfKfd8RSeBSIh38l3EB26Z+zGAZFx2C9F93YmyHRXrrr/3Lv2zL7bn03sMNZer6Iusu/up/V+wIdYZqKcKUOZJC4mGMhJjQJ4lId9TZ40t8=Received: (qmail 20491 invoked by uid 1002); 28 Apr 2023 15:12:39 -0000Received: (qmail 20465 invoked by uid 1002); 28 Apr 2023 15:12:38 -0000Received: from s466.sureserver.com (192.252.146.28) by s807.sureserver.com with SMTP; 28 Apr 2023 15:12:38 -0000DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=icdtest.net; h=message-id:date:mime-version:from:subject:to:content-type:content-transfer-encoding; s=dkim; bh=a+6z9N9M4Z1sFKIixisE8eG5osnzDYVSQob1aq6RKk8=; b=M3l4kKN4prAHvtqIan3+dx+f4JDcuKUqltzOtZQiDQBvBKM6ueBUDhN9tqNpIyhWi/b0fcN9W+PAUZAS2UF/aoTW1uQxjwdZ9SrQJvEPo8Fd5LMF4FKtAPsBp9LH26hOZo0MVP2NcyCRRqk5HyGmtJTH+pWiLpjcN0orhuNDwa0=Received: (qmail 53050 invoked by uid 1003); 28 Apr 2023 15:12:36 -0000Received: (qmail 53025 invoked by uid 1003); 28 Apr 2023 15:12:36 -0000Received: from unknown (HELO ?94.155.37.245?) ([emailprotected]@94.155.37.245) by s466.sureserver.com with ESMTPA; 28 Apr 2023 15:12:36 -0000Message-ID: <[emailprotected]>Date: Fri, 28 Apr 2023 18:12:34 +0300MIME-Version: 1.0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Thunderbird/102.6.1From: John Smith ICDSoft <[emailprotected]>Subject: Forwarding testTo: [emailprotected]Content-Language: bg, en-USContent-Type: text/plain; charset=UTF-8; format=flowedContent-Transfer-Encoding: 7bitDelivered-To: [emailprotected]Delivered-To: [emailprotected]Content-Length: 32This email will be forwarded.

Some email headers stand out:

• Delivered-To: [emailprotected]
  Delivered-To: [emailprotected]

  Two Delivered-To headers. This shows that the message was first delivered to [emailprotected], then to [emailprotected], and finally to [emailprotected].

• Received: from 10.197.34.204 by atlas116.free.mail.bf1.yahoo.com pod-id NONE with HTTPS; Fri, 28 Apr 2023 15:12:41 +0000
  Received: from 195.8.222.25 (EHLO s807.sureserver.com) by 10.197.34.204 with SMTPs (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256); Fri, 28 Apr 2023 15:12:41 +0000
  Received: from s466.sureserver.com (192.252.146.28) by s807.sureserver.com with SMTP; 28 Apr 2023 15:12:38 -0000
  Received: from unknown (HELO ?94.155.37.245?) ([emailprotected]@94.155.37.245) by s466.sureserver.com with ESMTPA; 28 Apr 2023 15:12:36 -0000

  These lines show the route of the message and are best read from the bottom to the top. The message was first sent from [emailprotected] via s466.sureserver.com, then it was delivered to s807.sureserver.com, after which it was forwarded and received at Yahoo.

• Return-Path: <SRS1-LNPzUwy8=s466.sureserver.com=-dYsHhaIs=AT=icdtest.net=johnsmith@s807.sureserver.com>

  The Return-Path header of the message forwarded to Yahoo is modified by the forwarding server via the Sender Rewriting Scheme (SRS). This improves the deliverability of forwarded emails, because the SPF configuration of the matching authenticated domain lists the server's IP address as permitted sender. This way, messages sent on behalf of icdtest.net (forwarded emails) through a third-party server (s807.sureserver.com) pass the SPF check. The SRS works backwards as well, so replies to the SRS address will still reach the original sender. In this case, if a reply is sent back to SRS1-LNPzUwy8=s466.sureserver.com=-dYsHhaIs=AT=icdtest.net=johnsmith@s807.sureserver.com, this address will be transformed to [emailprotected] on our end, and the reply will be delivered there. Many email service providers have not introduced SRS (Sender Rewriting Scheme) yet, and these providers suffer from increased rates of email delivery issues, particularly when it comes to forwarding emails. Without SRS, forwarded emails often fail SPF (Sender Policy Framework) checks because the original sender's IP address does not match the forwarding server's IP address. This mismatch can lead to legitimate emails being marked as spam or outright rejected by receiving email servers, significantly impacting email deliverability and sender reputation.

In Conclusion

Email headers can be very useful to trace an email - from the originating server to the final recipient. The headers also show important information regarding the authenticity of the message. Learning more about email headers could also protect you against spam and phishing emails, because spammers often send spoofed messages which only appear as sent from a known entity, but are actually sent via compromised servers and email systems.

If email headers still seem confusing, it is because they are. At ICDSoft, we have a team of experienced support persons, who can help you decipher the email headers, just post a ticket through our support systems.