Reading the Received lines
Each server that handles a message adds a Received: line at the top, so the newest is first and the oldest last. The analyzer reverses them to show the path in order, from the sending server to your inbox.
| Part | Meaning |
|---|---|
| from mail-sor-f41.google.com [209.85.220.41] | The server that handed the message over, and its IP |
| by mx.example.com | The server that received it |
| with ESMTPS | The protocol; an S at the end means the hop was encrypted |
| ; Tue, 21 Oct 2026 09:14:07 -0700 | When it was received, used to calculate delays |
Key headers to check
- Authentication-Results: what your provider found when checking SPF, DKIM and DMARC.
- Return-Path: where bounces go; it should belong to the sender or their mail service.
- Reply-To: where your reply would go. A Reply-To at a different domain is a classic phishing trick.
- Message-ID: usually shows which system created the message.
Found a suspicious IP? Check it with the blacklist checker, see who owns it with the IP WHOIS lookup, or estimate its location with IP Location.