An email header is the block of technical metadata carried at the top of every message, above the visible subject and body. It records the chain of mail servers the message passed through (the "Received" lines, read bottom to top), the originating IP address in many cases, timestamps, and authentication results such as SPF, DKIM, and DMARC that show whether the sender was who they claimed to be.
For investigators, the header is where an email's real story lives. A display name and "From" address are trivially forged, but the Received chain and authentication results are much harder to fake and can reveal the true sending server, the sender's approximate location, and whether a message is spoofed or part of a phishing campaign. Reading headers is a core skill in email and fraud investigation.