• AT&T DSL Internet
• Verizon DSL Internet
• Comcast Internet
• Time Warner Internet
• Cox Cable Internet
• Charter Cable Internet
• NetZero HiSpeed

Satellite Internet

• DIRECTV Satellite
• Dish Network Satellite
• HughesNet Satellite
• Wildblue Satellite
• Skyway USA Satellite
• Starband Satellite

Wireless Internet

• AT&T Wireless Internet
• Verizon 3G Wireless

Fiber Optic Internet

• AT&T U-Verse Review
• Verizon FiOS Review

High Speed Topics

• ISP Comparison
• Internet Speed Test
• DSL vs Cable
• Free Internet Service

Home > Articles > Email Headers

How To Read Email Headers

One of the more difficult ideas for a novice Internet user to grasp involves email headers. No matter the email provider, these headers are found on all emails. It’s important to learn how to read an email header because it helps an individual report abuse from another user and discover where scam emails come from. The first step involves looking directly at an email header such as the following one:

Return-path:
Received: from ppp@glaring.ty (ppp.glaring.ty [000.000.000.00]) by XXXXX.XXXX.ORG (PMDF V5.2-22#0000) with ESMTP id
Date: Tue, 21 July 2009 10:22:20 +0800
From: Nice Girl
Subject: What’s Up?
To: sarah@jp.glaring.ty
Cc:
Message-id:

The first step in looking at an email header is to expand it, which shows the hidden data. This varies depending on the program, but it’s easy to find. In Google’s G-mail, there’s an option at the top of the email that states “show details”. When this is clicked, it shows the entire header of the email. Other programs follow a similar system that lets users expand the header by clicking on a link.

Next the user should look at the return-path and the email address displayed there. This is sometimes the actual email address of the sender, though it can also be forged by spammers. Instead of relying solely on that information the user should look at the received area, which shows the IP address of the sender as well as the original destination of the sender. The received area is the most important part of the email header, but also the one hardest to read.

The first step of reading this part of the header is finding the host name, which is the name listed before the end of the address, in this case the XXXX before the .org. The actual name of the host is listed in front of the IP address, which is ppp.glaring.ty in the example. The user can also read the IP address of the sender, established in a 000.000.000.00 format, only with different numbers in a real email.

Those who read the received area of an email can also discover if the sender used a third party for access by looking at the for section. If the word “for” follows the original host name, it means they used a third party to actually send the email, which is common with spammers. The series of letters or numbers at the bottom, following the Message-id establishes the unique id of the original sender.

Resources On Email Headers:

• Determining the Origin of Email : explains how to read a header and determine where it came from.
• How To Analyze E-mail Headers from Spam: outlines what to look for in a spam message.
• Reading Email Headers : provides resources on better tackling headers and emails with hidden headers.
• Reading Email Headers : focuses on headers used by the Google email system G-mail.
• Tracking the Source of Email Spam: breaks down the elements of an email header to determine where a spam email was sent from.
• Analyzing Email Headers : offers a step by step process to analyze and read and email header.

You can use our site to compare the various types of Internet Service Providers in the U.S., such as fiber optics, DSL, cable and wireless.