How to view full email headers

Why look at the headers

The name and address shown at the top of a message are easy to fake. The headers record what the receiving mail server actually saw, so they are where a spoofed sender, a hidden Reply-To or a failed authentication check shows up.

Clients call the same thing different names: Show original in Gmail, Internet headers or message details in Outlook, All Headers in Apple Mail, Message Source in Thunderbird. You need the full text, not the shortened From, To and Subject block.

Gmail

1. Open Gmail in a browser on a computer and open the message.
2. Next to the Reply button, click More (the three dots).
3. Click Show original. The full message opens in a new window.
4. Click Copy to clipboard to copy it.

Outlook

New Outlook for Windows, Outlook on the web and Outlook.com

1. Open the message.
2. At the top of the message window select More actions.
3. Select View, then View message details.

Classic Outlook for Windows

1. Double-click the message so it opens in its own window, not in the reading pane.
2. Choose File, then Properties.
3. The headers are in the Internet headers box. Click in it, press Ctrl+A and Ctrl+C to copy.

Apple Mail

1. Select the message in Mail on your Mac.
2. In the menu bar choose View > Message > All Headers.

In the web version of Mail at iCloud.com, open the message, select the More button and choose Show All Headers.

The All Headers view is hard to copy from. To get the whole source as a file, save the message as .eml instead, as described in how to save an email as an .eml file.

Thunderbird

1. Select or open the message.
2. Press Ctrl+U (Cmd+U on a Mac), or choose View > Message Source. The raw message opens in a new window with the headers at the top.

To show all header lines above the message in the reading pane, use View > Headers > All and switch back to Normal afterwards. If the message is open in the reading pane, its More button also offers View Source.

On a phone or tablet

The official help pages for Gmail and Outlook describe headers only for computers. If the suspicious message sits in a phone app, the dependable route is to open the same mailbox on a computer (webmail is enough) and follow the steps above.

What to look for

Headers are long. Start with these lines, which are usually near the top:

Authentication-Results: mx.example.net;
  spf=fail [email protected];
  dkim=none;
  dmarc=fail header.from=examplebank.com
Return-Path: <[email protected]>
From: "Example Bank" <[email protected]>
Reply-To: [email protected]
Received: from unknown (203.0.113.45) by mx.example.net

• Authentication-Results shows whether SPF, DKIM and DMARC passed. A DMARC fail on a message claiming to come from a bank is a strong warning sign. See what DMARC, SPF and DKIM fail mean.
• From is what you see in the inbox. Return-Path and Reply-To show where bounces and your replies really go. A different domain in each is worth a second look.
• Received lines trace the servers the message passed through, newest first. The bottom one is closest to the real sender.

You do not have to decode this by hand. Paste the whole thing into AntiBait and it reads the authentication results, the sender chain and the links for you.