Email headers: how to trace a message path

Received fields are prepended by mail systems as a message moves through SMTP infrastructure. From is a presentation/authorship field and can differ from the authenticated envelope or domain, so tracing a message requires several fields rather than one visible address.

Which headers reveal a message path

Mail servers prepend Received fields as a message moves through SMTP infrastructure. Together with Authentication-Results, Message-ID and other technical fields they help reconstruct the message path; the visible From field alone does not establish the source.

How to read Received and Authentication-Results

Open the raw message and read Received fields from the bottom upward; lower entries are usually closer to the start of the path. Check Authentication-Results, SPF, DKIM and DMARC separately. The visible From field is easy to spoof and is not sufficient evidence of origin. If you need to check the address itself, use 2ip e-mail check; still use the headers to investigate message origin.

Why the From field is not enough

Technical references: RFC 5322 and RFC 5321.