Not all of the email headers can be faked. Once the email message is received by a trusted server which provides your email service, the Received: headers are reliable.
Consider this string of Received: headers:
Received: by 10.142.214.19 with SMTP id m19cs274738wfg;
Thu, 17 Dec 2009 03:20:12 -0800 (PST)
Received: by 10.115.67.30 with SMTP id u30mr1589591wak.119.1261048811650;
Thu, 17 Dec 2009 03:20:11 -0800 (PST)
Received: from mail1.stackoverflow.com (mail1.stackoverflow.com [69.59.196.214])
by mx.google.com with ESMTP id 31si4514829pzk.62.2009.12.17.03.20.11;
Thu, 17 Dec 2009 03:20:11 -0800 (PST)
Received: from superuser.com (unknown [10.0.0.4])
by mail1.stackoverflow.com (Postfix) with ESMTP id 67A7F1E08A;
Thu, 17 Dec 2009 03:20:11 -0800 (PST)
The bottom-most Received: header is followed by the body of the message, which includes To: and From: headers, which can be forged. But let's follow the Received: headers:
The first header indicates that a server on IP address 10.0.0.4 named superuser.com sent a message to the server mail1.stackoverflow.com. Knowing that both of these names are to be expected in this case, the Received: header indicates an internal forward within the superuser complex of mail servers.
The next Received: header indicates that mail1.stackoverflow.com at address 69.59.196.214 forwarded the message to mx.google.com. We can confirm that the public IP address of mail1.stackoverflow.com is 69.59.196.214 and since google is my email provider, I would expect the mail-exchanger (mx) at google.com to be receiving my message. This is the first contact with my mail domain (google) and cannot be faked. Of course, there could be a load of faked Received: headers below this header, so finding the first reliable Received: header can be tricky.
The last two Received: headers show net 10 addresses, so these are forwards within the google domain. This is also not unexpected.
An evil mail server could insert many fake Received: headers into the stream, but there is always one that comes from a trusted source, in this case mx.google.com. This first trusted Received: header indicates the public IP address that actually forwarded the email. If this IP address is suspect, or does not match the reported domain name, then you must suspect the entire contents of the message.
You can read Received: headers in most email clients using a "view source" command. It takes a bit of skill to read bottom-up and find the first reliable Received: header, but once you find it, verifying it is quick and helpful.
4Just out of curiosity: Did it turn out to be a fake or real? – Lukas Knuth – 2013-07-08T16:19:17.387