Read Email Headers in Gmail to Check Spoofed Senders

An email can look genuine and still be fake. The sender name says it is your bank and the logo looks right, yet the message was sent by a criminal using spoofing, where the visible sender address is forged.

The truth about an email’s origin is written in its headers, a block of technical information that travels with every message. Gmail lets you view those headers in a few clicks, and you do not need to be an expert to spot the warning signs. This guide explains how to open email headers in Gmail and how to check the key lines that reveal whether a sender is real or spoofed.

Quick Answer

To read email headers in Gmail, open the message, click the three-dot menu next to Reply, and choose Show original. On that page, first check Gmail’s summary at the top: if SPF, DKIM, and DMARC all show PASS for the sender’s domain, the message is properly authenticated. If any show FAIL, or the mailed-by and signed-by domains do not match the From address, the email is suspicious and may be spoofed, so do not click its links or follow its requests until you verify it another way.

What Spoofing Is and Why Headers Reveal It

The From line you see is like a return address handwritten on an envelope: anyone can write anything there. Spoofing means a sender writes a familiar address, such as your bank, on a message they have no right to send.

Headers are harder to fake because most are added by servers, not the sender. Each server stamps a Received line, and security checks test whether the sending server is authorised for that domain. Those results are what you read on the Show Original page.

How to Open Full Headers in Gmail, Step by Step

1. Open Gmail on a computer. Show Original is a desktop feature. On a phone, you can use Gmail in a desktop browser view, but a computer is far easier.
2. Open the suspicious message. Do not click any links or download any attachments inside it while you investigate.
3. Click the three-dot menu at the top right of the message, next to the Reply arrow.
4. Choose Show original. A new tab opens with a summary table at the top and the full raw headers below it.
5. Read the summary first. Gmail shows the From address, the SPF, DKIM, and DMARC results, and the dates the message was created and delivered.
6. Scroll into the full headers only if you need detail. Use your browser’s Find function, Ctrl+F or Command+F, to search for words like Authentication-Results, Received, Return-Path, and Reply-To.

Google explains this feature in its help page on tracing a message with its full headers in Gmail. If your goal is to report the message afterwards rather than just inspect it, that same page also points toward the right reporting options.

The Three Checks That Matter Most: SPF, DKIM, and DMARC

SPF: Was This Server Allowed to Send for That Domain?

SPF, short for Sender Policy Framework, is a list published by a domain owner naming the servers allowed to send email for that domain. When a message arrives, Gmail checks whether the sending server is on that list. PASS means the server was authorised. FAIL or SOFTFAIL means it was not clearly authorised, which is a warning sign, especially for a message claiming to be from a bank or a large company that normally gets this right.

DKIM: Is the Message Signed and Unchanged?

DKIM, or DomainKeys Identified Mail, adds a digital signature to the email. Gmail checks the signature against a public key published by the domain. PASS means the message was signed by that domain and was not changed on the way to you. A missing signature is not proof of a scam, because some small senders do not sign, but a FAIL on a message from a major organisation deserves real caution.

DMARC: Did the Owner’s Policy Say This Is Aligned?

DMARC ties SPF and DKIM together and tells receiving servers what to do when checks fail. Gmail shows a DMARC result when the domain publishes a policy. PASS means at least one of the identity checks succeeded and the domain in the result matches the visible From domain. That match, called alignment, is the heart of anti-spoofing, because it stops a stranger from passing checks using their own unrelated domain.

Other Header Lines Worth Checking

• From versus Return-Path: The Return-Path is where bounces go. In a genuine email it usually belongs to the same domain as the From address, or to a known sending service for that company. A Return-Path on a strange, unrelated domain is suspicious.
• Reply-To: If the Reply-To address differs from the From address, your reply goes somewhere else entirely. Scammers use this trick so that a message appearing to come from a boss routes your answer to them. A different Reply-To is sometimes legitimate for newsletters, but it is a red flag in a personal or financial request.
• Mailed-by and Signed-by: In the message details dropdown inside Gmail, these fields show the sending and signing domains without opening full headers. Both should relate sensibly to the sender. A bank email mailed by a random free domain is a bad sign.
• Received chain: Read the Received lines from bottom to top, because the oldest stamp is at the bottom. They show the journey from sender to Gmail. You do not need every detail; look for a sending server or country that makes no sense for the claimed sender, and for long delays between the created date and delivery.

If reading headers shows the address does not match what you expected, combine it with the visual checks in our guide on recognising a phishing email before you act on it. Headers and message content together give a much stronger judgement than either check alone.

A Simple Worked Example of a Spoof Check

Imagine an email that appears to be from your bank, warning that your account will be closed unless you sign in today. The From address uses the bank’s real domain, which looks reassuring. But Show Original shows SPF FAIL, DKIM FAIL, a mailed-by domain unrelated to the bank, and a Reply-To pointing to a free email address. The conclusion is clear: the From line was written by the sender, but every server-side check disagrees. Report the message and contact your bank through its official app instead.

What to Do When the Headers Look Suspicious

1. Do not act on the message. Do not click links, open attachments, or send the payment or information it requests.
2. Verify through a separate channel. Call the sender on a number you already trust, or open the company’s official app or website by typing the address yourself.
3. Report it in Gmail. Back in the message’s three-dot menu, choose Report phishing if the message is impersonating someone. Use Report spam for general junk.
4. Keep evidence if money or threats are involved. Download the original message so the full headers are preserved, and share that file with your IT team, your bank’s fraud team, or the provider’s abuse desk.
5. Warn others if it targeted your workplace. A spoof that reached you probably reached colleagues too. A short alert to your team can prevent a real loss.

Common Mistakes and Misunderstandings

• Trusting the display name: The friendly name next to an address is typed by the sender and proves nothing. Always check the actual address and headers.
• Treating one PASS as a total guarantee: A message can pass SPF using the attacker’s own domain while spoofing the visible From domain. Alignment matters, so look at whether the passing domain matches the From domain.
• Panicking over a missing DKIM signature: Some genuine small senders do not sign. Treat a missing signature as neutral.

Conclusion

Reading email headers in Gmail takes less than a minute once you know the route: open the message, choose Show original from the three-dot menu, and check the SPF, DKIM, and DMARC results first. Then glance at the Return-Path, Reply-To, and mailed-by domains and ask one simple question: does the technical evidence match who this email claims to be from? When everything passes and aligns, you can relax. When checks fail or domains do not match, treat the message as spoofed until a separate, trusted check proves otherwise. That habit alone will protect you from most impersonation scams.

Frequently Asked Questions

Where is Show original in Gmail?

Open the message on a computer, click the three vertical dots at the top right of the message next to the Reply arrow, and choose Show original. A new tab displays a summary with SPF, DKIM, and DMARC results, followed by the complete headers.

What does SPF FAIL mean in simple terms?

It means the server that delivered the email is not on the list of servers authorised to send for that domain. For a message claiming to be from a bank or large company, that is a strong warning sign of spoofing, because genuine senders normally pass this check.

An email passed SPF and DKIM. Can it still be a scam?

Yes. A scammer can send from their own domain with perfect authentication and simply write a deceptive message, or they may have compromised a real account. Passing headers prove the domain sent it, not that the request inside is honest. Always judge urgent money or password requests with extra care.

Can I check headers in the Gmail app on my phone?

The Gmail app shows limited details, such as the sender’s full address when you tap the name, but it does not offer Show Original. For full headers and authentication results, open Gmail on a computer browser and follow the steps in this guide.

What should I look at first if the header page looks overwhelming?

Ignore the long text at first and read only Gmail’s summary table at the top of the Show Original page. Check the three result lines for SPF, DKIM, and DMARC. Three passes with the correct domain is reassuring. A fail, especially on a financial or personal request, is your cue to stop and verify the message another way.