Received
The header each mail server adds as a message passes through it. Read from the bottom up, the Received lines reconstruct the route a message actually travelled.
Every server that handles a message prepends a Received header describing the handover: which host it came from, which host accepted it, over what protocol, with which internal id, and at what time. Because each is added at the top, the oldest line sits at the bottom — so a message's journey reads upwards, from the sender's first server to the one that delivered it into the mailbox.
These headers are the closest thing an email has to a paper trail. They reveal how long a message spent at each hop, whether it went through a mailing list or a corporate gateway, and which IP address it entered the internet from. In investigations and disclosure requests they are usually the first thing anyone looks at.
They deserve a caveat, though. A server can only vouch for what it did itself: Received lines below the first host you trust may have been fabricated by whoever sent the message. That is why they are read together with the authentication results — SPF, DKIM and DMARC — rather than on their own. Mbox Viewer shows the full set under Full Headers, and mboxShell under its raw view.
Related terms
The structured metadata block at the beginning of an email message, containing fields like From, To, Subject, Date, and numerous technical fields that describe how the message was composed, routed, and encoded.
Simple Mail Transfer Protocol — the standard protocol used to send and relay email messages between mail servers. It is used for outgoing mail only; reading email requires IMAP or POP3.
The three mechanisms that establish whether a message really came from the domain it claims: SPF authorises sending servers, DKIM signs the message cryptographically, and DMARC ties the two to a published policy.