What do “Received” headers mean?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Received headers are added by every mail server that processes a message. Each header records one hop in the delivery chain. Reading them reveals the complete path from sender to recipient.
A typical Received header:
Received: from mail.example.com (mail.example.com [192.0.2.1]) by mx.recipient.com with ESMTPS id abc123 for <user@recipient.com>; Tue, 5 Feb 2026 10:30:00 -0500
Breaking it down:
- from: The server that sent the message (claimed hostname and verified IP)
- by: The server that received it
- with: Protocol used (SMTP, ESMTP, ESMTPS for TLS-encrypted)
- id: Server's internal tracking ID
- for: Recipient address
- timestamp: When this server received the message
Reading order: Received headers stack on top. The newest (last server) is at the top; the oldest (origin) is at the bottom. Read bottom-up for chronological order.
Forensic use: Compare timestamps to find delays. Check IPs against reputation databases. Verify the path matches expected routing.
Each Received header is a port-of-call stamp in the ship's passport.
The most useful email questions, once a month
One email a month. New questions worth reading, real deliverability changes (Gmail and Outlook updates, etc.), and any tool or report that landed since the last issue. No fluff, no upsell.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
