Email headers explained: the fields that matter
A beginner friendly guide to email headers: sender identity, SPF, DKIM, DMARC and routing evidence, and what each one does and does not prove about a message.
Choose the explanation that suits you. Both versions cover the same topic.
Think of headers as delivery notes
An email has hidden notes about how it travelled. You do not need to understand every line. Jatzo organises the useful parts for you.
The name can be misleading
A message can display the name of your bank or manager without coming from them. Look at the full address and verify important requests separately.
A reply can go somewhere else
The reply address may differ from the sender address. Sometimes this is normal for a customer-support service. Sometimes it redirects your reply to someone else.
What do the pass results mean?
SPF, DKIM and DMARC are checks used by mail services. A pass can support a domain connection, but a criminal can own a domain that passes these checks too.
The location is a clue, not a person
A source IP describes a computer network involved in delivery. Cloud services often use other countries. A map or country name cannot tell you who wrote the email.
Combine the clues
Use the message request, sender, links and attachments together. If a payment or login request is unexpected, check it through a trusted channel even if the delivery notes look normal.