How to find and read email headers.

Open the message, click the three dots next to Reply, and choose Show original. Copy everything on that page, or click Copy to clipboard, and paste it into the analyzer. The summary table at the top is skipped automatically.

In Outlook on the web or the new Outlook, open the message, click the three dots, then View and View message source (or View message details). In classic Outlook for Windows, open the message, then File, Properties, and copy the Internet headers box.

In Apple Mail on a Mac, open the message and choose View, Message, All Headers, or Raw Source. The iPhone Mail app can't show headers, so open the message on a computer or in your provider's web mail. In Yahoo Mail, click the three dots and choose View raw message.

Each server that handles a message adds a Received line at the top, saying where it got the message from and when. Read from the bottom up, they trace the route from the sender's server to your inbox. The time between two lines is how long that step took. Lines near the bottom can be made up by the sender; the ones your own provider added at the top are reliable.

SPF checks that the server that sent the message is on the sending domain's list of allowed servers. DKIM checks a signature that proves which domain sent the message and that it wasn't changed on the way. DMARC ties them to the From address you see: it passes when SPF or DKIM passes for a domain that matches it, and the domain's policy says what to do when it doesn't.

The Return-Path is where bounces go. Newsletters and other mail sent through an email service often use the service's domain there, which is normal. It's worth a closer look when there is also no passing DKIM signature from the From domain, because that is how a forged sender looks.

The headers show whether the sending domain approved the message, not whether the sender is honest: a scammer can send fully authenticated mail from a lookalike domain they own. Check the From domain letter by letter, be wary when replies go to a different domain, and contact the company another way if a message asks for money, passwords or codes.

No. On the web page the headers are read in your browser and never sent to us. The API, MCP server and command line send them to Lemon Domains to be read, and the answer comes straight back; the headers aren't saved or logged.

Yes. The Lemon Domains MCP server has an analyze_email_headers tool, the REST API serves the same check at POST /api/v1/email/headers, and the lemon command line runs it with lemon email-headers message.eml.