A message header is the metadata attached to an email message. It records details such as sender and recipient fields, message IDs, timestamps, server hops, and authentication results. In an investigation, headers help analysts trace how a message moved across mail servers, where it may have originated, and whether it was altered in transit.
Message headers matter in cyber security because they support phishing analysis, spoofing detection, and incident reconstruction. Attackers often fake display names or envelope fields, but they cannot fully hide the routing history written into headers and server logs. Defenders compare headers with SMTP logs, mail gateway records, SPF, DKIM, and DMARC results to spot relay abuse, compromised accounts, or suspicious forwarding. A header alone is not proof of compromise, but it is a key part of the evidence chain.