How to read an email's headers

Every email carries a block of headers above the part you normally read. Most clients hide them behind “Show original” or “View source”. Two of them are worth learning to read: one tells you how easy it is to unsubscribe, the other how confident you can be about who really sent the message.

You can paste headers straight into our Unsubscribe & headers checker — this article explains what it’s reading.

List-Unsubscribe (RFC 2369)

This header advertises how to opt out. It contains one or two URIs in angle brackets:

List-Unsubscribe: <https://brand.example/u/one-click?id=a8f3e1c9b2>, <mailto:unsub@brand.example>

• A mailto: entry means your client can unsubscribe you by sending an email.
• An https: entry means there is a web endpoint to unsubscribe you.

On its own, following the https: link might just open a web page — not necessarily a completed opt-out. That’s where the next header comes in.

List-Unsubscribe-Post (RFC 8058)

List-Unsubscribe-Post: List-Unsubscribe=One-Click

When this header is present together with an https: List-Unsubscribe URL, the sender supports one-click unsubscribe: your mail client can send a single POST request that completes the opt-out with no web page and no form. Gmail and other providers show a prominent “Unsubscribe” button precisely when they see this pair.

If you see List-Unsubscribe-Post but no https: URL, the setup is broken — it doesn’t meet RFC 8058 and one-click won’t work.

Authentication-Results (SPF / DKIM / DMARC)

This header records whether the message passed sender-authentication checks. It’s added by the receiving server, so it reflects what your provider concluded:

Authentication-Results: mx.example.com; spf=pass smtp.mailfrom=brand.example;
  dkim=pass header.d=brand.example; dmarc=pass

In plain terms:

• SPF — was the sending server authorised to send for that domain? (pass = yes)
• DKIM — is the message cryptographically signed, and does the signature check out? (pass = the content wasn’t tampered with in transit and comes from the signing domain)
• DMARC — do SPF/DKIM align with the visible “From” domain, and does the domain’s published policy accept the result? (pass = the From address is trustworthy)

A dmarc=fail is the loudest warning sign: the visible sender may be spoofed. spf=softfail or dkim=fail weaken confidence but sometimes just mean the message was forwarded.

Reading the folded lines

Headers can wrap onto multiple lines; continuation lines start with a space or tab and belong to the header above them. When you copy headers, keep that indentation so a parser (including ours) can reassemble them correctly.

Why bother

Together these headers let you judge, before you click anything, whether a message offers a clean exit and whether it’s genuinely from who it claims. They’re also a useful reality check on a sender’s overall hygiene — brands that get authentication and one-click unsubscribe right tend to take the rest seriously too.