An email is made up of three fundamental parts: headers (technical metadata), the body (the visible message), and attachments (additional files). Understanding each one helps you troubleshoot delivery issues, improve presentation, and keep your messages out of the spam folder.
If you've ever wondered why an email landed in spam, why formatting broke when you forwarded it, or what "MIME-Version" means in technical metadata, this guide answers all of that.
Email Headers: The Technical Passport
Headers are lines of text that travel with the message but stay invisible to the everyday user. They contain all the information mail servers need to route, authenticate, and deliver the email.
Required headers
- From: the sender's address. Some clients distinguish between the technical From address and the Display Name shown to the recipient.
- To: the primary recipient. Multiple addresses can be listed, separated by commas.
- Subject: the email's subject line. There's no hard technical limit, but lines over 78 characters may be truncated in some clients.
- Date: the timestamp of when the client generated the message (RFC 5322).
- Message-ID: a globally unique identifier for the email, generated by the sending server. It's used to track threads and replies.
Routing headers
Every server the email passes through adds a Received: line. Reading them from bottom to top shows you the exact path the message took — useful for identifying delays or problem servers.
Authentication headers
These headers determine whether your email looks legitimate or like potential spam:
- DKIM-Signature: a cryptographic signature guaranteeing the message wasn't tampered with in transit.
- Received-SPF: the result of SPF verification — whether your domain authorized the server that sent the email.
- Authentication-Results: a summary from the receiving server of SPF, DKIM, and DMARC results.
You can inspect all these headers in Gmail by clicking the three-dot menu on a message and selecting "Show original."
The Body: What the Recipient Reads
The body is the visible content. Technically, it's defined as the section that comes after the headers, separated by a blank line.
Plain text vs. HTML
Most modern emails are sent as multipart/alternative: they contain both a plain-text version and an HTML version inside the same message. The recipient's email client chooses which one to display based on its settings.
| Format | Advantages | Disadvantages |
|---|---|---|
| Plain text | Universal compatibility, very small size, rarely flagged as spam | No colors, images, or visual formatting |
| HTML | Rich design, images, buttons, brand colors | May be blocked in some corporate environments |
| Multipart/alternative | Best of both worlds: the client decides | Heavier message size |
Content encoding
The body is typically encoded as quoted-printable (for text) or base64 (for images and binary data). The Content-Transfer-Encoding header indicates which encoding is used for each part of the message.
The character set (charset) most commonly used today is UTF-8, which supports accented characters, emojis, and virtually any language without character corruption.
Attachments: Files Inside the Envelope
Attachments are files embedded inside the email, encoded in base64. They don't travel "alongside" the message — they literally become part of the same text file that makes up the email. That's why messages with large attachments can be several megabytes in size.
How they're structured
An email with attachments uses the MIME type multipart/mixed. Inside it there may be:
- A
multipart/alternativepart containing the body (plain text + HTML). - One or more parts typed as
application/octet-stream,application/pdf,image/jpeg, etc., each with aContent-Disposition: attachment; filename="..."header.
Size limits
Attachment size limits are set by the mail server, not the standard itself. Typical values:
| Provider / Server | Limit per message |
|---|---|
| Gmail / Google Workspace | 25 MB |
| Microsoft 365 | 25 MB (default) |
| cPanel / Shared hosting | Configurable, typically 25–50 MB |
| Corporate servers | Variable, sometimes as low as 10 MB |
For files larger than the server's limit, the right approach is to share a link to Google Drive, Dropbox, or another cloud storage service.
Why Understanding Email Anatomy Matters
Knowing these parts has direct practical applications for any business:
- Delivery troubleshooting: headers tell you exactly where an email was rejected or delayed.
- Avoiding spam: misconfigured authentication headers (SPF, DKIM, DMARC) are the number-one reason legitimate emails land in spam.
- Template optimization: knowing the body is sent as multipart reminds you to always include a plain-text version.
- Security: email spoofing attacks manipulate the visible
Fromfield; checking theMessage-IDand authentication results lets you detect them.
If your business uses a custom-domain email, browse the business email articles for deeper guidance on configuration, security, and best practices.
Key takeaways
- Every email has three zones: headers (routing and authentication metadata), body (visible content in text and/or HTML), and attachments (files encoded in base64).
- The Received:, DKIM-Signature, and Authentication-Results headers are the most useful for diagnosing problems.
- Multipart/alternative is the modern standard: it includes both plain text and HTML for maximum compatibility.
- Attachments are embedded in the message itself; exceeding the server limit prevents delivery.
- Correctly configuring SPF, DKIM, and DMARC is essential for reaching the inbox, not the spam folder.
Want your business email set up with proper authentication from day one? At elenlace.com we configure your professional email with a custom domain, SPF, DKIM, and DMARC included — so your important messages never end up in spam again.
FAQ
Can I view email headers in any email client?
Yes. In Gmail choose "Show original"; in Outlook use "View source"; in Apple Mail enable View → Message → All Headers. Every client allows you to inspect technical headers, though the exact path varies.
Why can the "From" field show a legitimate name but come from a different address?
The From field has two parts: the display name and the actual address inside angle brackets. Attackers use legitimate-looking names with fake addresses; checking the address inside <> and the authentication results reveals the trick.
What happens if an email doesn't include a plain-text version?
Some spam filters penalize HTML-only emails, since it's a common tactic for hiding malicious content. Always including a plain-text version improves deliverability and compatibility with screen readers.
Are email attachments stored on the server indefinitely?
Yes, for as long as the message is in the mailbox. Each attachment consumes quota space for both the sender and recipient. For large inboxes, periodically archiving or deleting heavy messages keeps storage in check.
Prefer it done for you? El Enlace handles hosting and professional web development.
Further reading
Other providers and guides worth comparing:
