Two messages, one of them honest
Every email has two parts: the body you read, and the headers your mail client hides. The headers are a delivery log. Each mail server that handles the message adds a line, and the receiving server records whether authentication passed. Attackers control the body completely. Most of the headers are written by servers they do not control, which is why the headers are worth reading.
This lesson uses RFC 5322 (message format), RFC 8601 (Authentication-Results), and MITRE ATT&CK T1566 as the map. The map is not a licence to poke mail servers. You analyse mail you received, or mail someone asked you to investigate.
After this section you can say what a header is for, and why the display name in the inbox is the least interesting line on the page.
The body is the story the sender wants believed. The headers are the delivery docket, and the docket is usually less imaginative.