travel_exploreOSINTGuide
Intermediateschedule~25 min

How to Trace an Email's Origin From Its Headers

A method for reading the hidden headers of an email to reveal the servers it passed through, its likely origin, and whether it was spoofed.

The visible "From" line of an email is trivially forged. The truth lives in the email header — the hidden metadata recording the servers a message crossed and the authentication checks it passed or failed. Reading it tells you where a message really came from and whether to trust it.

What you'll need

Steps

  1. Extract the raw header. Open the message's original source so you can see every field, not just the friendly summary your client shows.
  2. Read the Received chain bottom-up. The lowest "Received" line is usually the origin; each line above is the next hop. Follow it up to find the first sending server and its IP address.
  3. Check authentication results. Look at SPF, DKIM, and DMARC. Failures — or a "From" domain that does not match the sending server — are strong signs of spoofing.
  4. Geolocate and attribute the source IP. Look up the originating IP for its owner and rough location; cross-check the sending domain's WHOIS records.
  5. Correlate with the content. Weigh the technical origin against the message's claims, links, and attachments to judge whether it is legitimate, spoofed, or phishing.

Common pitfalls

  • Trusting the display name. It carries no authority; only the header chain and auth results do.
  • Misreading the Received order. Read bottom to top — reversing it points you at your own mail server, not the sender.
  • Forgetting relays and services. Mailing lists and marketing platforms add legitimate hops that can look suspicious if misread.

Verify your result

You have traced the email when you can name the originating server and IP, state whether SPF/DKIM/DMARC passed, and explain whether the "From" address is genuine or forged.

Tools for this method

Key terms