Every day, your inbox fills up with messages. Some are from real people and real companies. But a growing number are fakes — scam emails pretending to be your bank, a delivery service, a social media platform, or even your boss. These fake messages are getting harder to spot because scammers have gotten good at copying logos, colors, and writing styles.

Here's the thing most people don't know: the part of an email you actually see is only half the story. Behind every message sits a hidden section called the email header. It's like the shipping label on the back of a package — full of details about where the email really came from, how it traveled, and whether it's genuine.

Once you learn how to read this hidden information, you gain a superpower. You stop guessing whether an email is real and start knowing. In this guide, we'll break down email headers in plain language, show you exactly how to find and read them, and explain how tools like temporary email can add another layer of protection to your daily life.

What Is an Email Header, Really?

Think about how a physical letter works. You see the envelope, the message inside, and the signature. But the postal system also stamps that envelope — the sending post office, the date, the route it took, the return address. That stamped information proves where the letter came from and how it got to you.

An email header does the exact same job, just digitally. Every email is actually made of two parts:

The body — the part you read. The subject line, the message, the images, the "click here" button.

The header — the hidden technical part that records the email's journey from sender to your inbox.

The body is easy to fake. Anyone can type "Your Bank" as the sender name and paste a bank logo. But the header is much harder to fake completely, because it's created by the mail servers that actually move the email around. That's why headers are your best friend when you're trying to tell real from fake.

What Information Does a Header Contain?

Email headers can look scary at first — lines and lines of code-like text. But you only need to understand a few key parts. Here are the ones that matter most.

From: This is the sender's name and address that shows up in your inbox. Important warning: this field is easy to fake. A scammer can make it say anything, including a real company's name. So never trust the "From" line by itself.

Return-Path: This is the address where bounce-back messages go if the email fails to deliver. Scammers often forget to match this to the "From" address. If the "From" says support@yourbank.com but the Return-Path says something random like x7392@weirdmailserver.ru, that's a huge red flag.

Received: This is the most useful part. It's a list of every mail server the email passed through on its way to you. It reads a bit like a travel history, from bottom to top. The bottom line shows where the email started, and the top line shows the last stop before your inbox. If an email claims to be from a big company but the "Received" lines show it came from a strange, unrelated server, something is wrong.

Message-ID: A unique code for each email, usually ending with the sender's real domain. If a "bank" email has a Message-ID ending in a totally different website, be suspicious.

Authentication results (SPF, DKIM, DMARC): These are three security checks that prove whether the sender is allowed to send email for that domain. You'll usually see words like pass or fail next to them. We'll cover these next because they're the closest thing to a lie-detector test for email.

The Three Security Checks That Expose Fakes

You don't need to be a tech expert to use these. Just look for three short words in the header and check if they say pass or fail.

SPF (Sender Policy Framework) checks whether the email came from a server that the real company approved. If SPF says fail, it means the email was sent from a server the real domain never authorized. Big warning sign.

DKIM (DomainKeys Identified Mail) is like a digital signature. It proves the email wasn't tampered with along the way and truly came from the claimed domain. A fail here means the message was either faked or changed.

DMARC (Domain-based Message Authentication) ties SPF and DKIM together and tells receiving servers what to do if something looks off. A pass means the email is very likely genuine. A fail means the domain's own rules say this message is suspicious.

Here's the simple rule to remember: if a message claims to be from a serious company like a bank, a payment app, or a government office, and any of these checks say "fail," treat it as fake until proven otherwise. Real companies almost always pass these checks.

How to Actually View Email Headers

Reading headers is useless if you don't know where to find them. Good news — it takes just a few clicks. Here's how on the most common platforms.

In Gmail (on a computer): Open the email. Click the three dots (⋮) in the top-right corner of the message. Choose "Show original." A new page opens showing the full header and the SPF, DKIM, and DMARC results right at the top in a neat little box. This is one of the easiest ways to check an email.

In Outlook (desktop app): Open the email in its own window by double-clicking it. Go to File > Properties, and you'll see the header text in a box near the bottom.

In Outlook.com (web): Open the email, click the three dots at the top-right, then choose "View" > "View message source."

In Apple Mail: Open the email, then go to View > Message > All Headers in the top menu.

On your phone: Mobile apps often hide this feature, so checking on a computer is easier. But you can usually tap the sender's name to at least see the full email address, which already reveals many fakes.

Once you've opened the header, don't panic at the wall of text. Just scan for the parts we discussed: the "From," the "Return-Path," the "Received" chain, and those SPF/DKIM/DMARC results.

Reading a Header to Catch a Scam — A Simple Walkthrough

Let's imagine you get an email that looks like it's from a popular shopping site, saying your account is locked and you must "verify" your details immediately. It looks perfect. The logo is right, the colors match. Should you trust it?

Open the header and check these five things.

First, compare the "From" and "Return-Path." If the display name says the shopping site but the Return-Path points to a random, unrelated address, that mismatch alone tells you it's fake.

Second, read the "Received" lines from bottom to top. A genuine email from a major company will show it starting at that company's official mail servers. If instead you see it beginning at some obscure server in a country that has nothing to do with the company, be alarmed.

Third, check the authentication results. Scroll to the SPF, DKIM, and DMARC lines. If you see fail or softfail, that's your answer. A real company email would almost always pass.

Fourth, look at the Message-ID domain. It should match the company's real website. A mismatch is a strong sign of forgery.

Fifth, trust the pattern, not any single line. One small oddity might be nothing. But two or three red flags together — a mismatched Return-Path, a failed SPF, and a weird server route — mean you should delete the email and never click a single link inside it.

Common Tricks That Headers Reveal

Scammers rely on you not looking at the header. Here are the tricks headers expose that the visible email hides.

Display name spoofing: The email shows a trusted name, but the actual address underneath is gibberish. The header shows the true address instantly.

Lookalike domains: The address uses a domain that's almost right but slightly off — an extra letter, a swapped character, or a different ending. It's easy to miss with your eyes but obvious once you read the header fields carefully.

Hijacked reply addresses: The email looks fine, but the "Reply-To" field secretly points somewhere else, so your reply goes straight to the scammer. Headers show this clearly.

Broken authentication: The message failed SPF or DKIM, meaning it was never authorized by the real domain. The visible email gives no hint of this; the header spells it out.

Where Temporary Email Fits Into Your Protection

Reading headers helps you catch fakes after they land in your inbox. But there's an even smarter move: reducing how many risky emails reach your real inbox in the first place. This is where disposable email comes in.

Here's the problem. Every time you sign up for a random website, download a free file, enter a giveaway, or try a new app, you hand over your real email address. Many of these sites sell or leak your address. Soon your inbox is flooded with spam and phishing attempts — the exact fake messages we've been talking about.

A temporary email address solves this. It's a throwaway inbox that works for a short time and then disappears. When you need to sign up for something you don't fully trust, you use a service like 10minutes.email instead of your personal address. You get the confirmation link, finish what you came for, and walk away. The spam and scam emails that follow land in the disposable inbox — not yours.

This connects beautifully with header reading. If you do want to inspect a suspicious sender safely, a disposable inbox lets you receive and examine that message without exposing your primary account or risking your reputation. You can open the header, study the "Received" chain and authentication results, and learn the sender's real tricks — all in a space that vanishes afterward.

Think of it as a two-layer defense. Temporary email keeps most junk away from your real inbox, and header reading helps you judge the messages that still get through. Together, they make you a much harder target than someone who simply trusts every email that looks official.

Your Quick Fake-Email Checklist

Keep this simple list in mind whenever an email feels even slightly off:

Don't trust the display name. Check the real email address behind it.

Open the header using "Show original" or your app's equivalent.

Compare From and Return-Path. Mismatches mean danger.

Read the Received chain from bottom to top. Strange origins are a warning.

Check SPF, DKIM, and DMARC. Any "fail" on a serious message means fake.

Never click links or download files from a message that fails these tests.

Use a disposable inbox for signups you don't fully trust, so fewer fakes reach you.

Final Thoughts

Fake emails work because most people only look at the surface. The scammer bets that you'll see a familiar logo, feel a little panic, and click before thinking. But you now know the secret they're counting on you to ignore: the email header.

You don't need to memorize technical terms or become a security engineer. You just need to slow down, open the header, and check a handful of fields. In under a minute, you can tell whether a message truly came from your bank or from a stranger halfway across the world pretending to be them.

Pair that habit with smart tools like temporary email, and you've built a personal defense system that most scammers simply can't get through. The next time a "too urgent to wait" email lands in your inbox, don't react — inspect. The truth is always hiding in the header, waiting for you to read it.