Received header
A trace header each mail server adds at the top of a message as it passes through, recording where it came from, which server received it, and when.
What it means
RFC 5321 requires every server that receives a message to prepend a Received field and never to change or remove earlier ones, so the headers read upward from the original sender to the final mailbox. A typical line names the sending host as it introduced itself in EHLO and its IP address, the receiving host, the protocol (ESMTPS means the hop used TLS), an ID, sometimes one recipient in a for clause, and a timestamp.
Received headers are how a message is traced: the time gaps between hops show where it waited, the first hop into the receiver shows the IP that was judged, and the protocol keyword shows whether each hop was encrypted. Lines below the first server you trust may have been written by anyone. RFC 5321 also uses their count to detect loops.
Example
Received: from mail.example.com (mail.example.com [192.0.2.25])
by mx.example.net with ESMTPS id 4f2a9c
for <ana@example.net>; Tue, 20 Oct 2026 09:15:02 +0200Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 5321, section 4.4: Trace Informationrfc-editor.org
- RFC 5322, section 3.6.7: Trace Fieldsrfc-editor.org
- RFC 3848: ESMTP and LMTP Transmission Types Registrationrfc-editor.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes