Where do I find email headers?

In Gmail: Open email → three dots → "Show original". In Outlook: File → Properties → Internet Headers.

What are SPF and DKIM?

Authentication mechanisms that verify the sender's domain. "Pass" means legitimate; "fail" may indicate spoofing.