Reading Email Headers

What are full headers?

Full headers are the entire headers of an email message, including every network hop and detail of the message's travels across the internet. If you want to contact support for help with a spam or other email-related issue, you will be asked to provide full header information for the email in question.

Full headers are more than the "From" and "To" lines your email client displays at the top of your email messages. Usually, the full headers are not needed and get in the way of an email's actual content. Email clients conceal the majority of the headers and just display the basics. These basic headers, though, are often forged and lack critical information for troubleshooting problems.

The full headers of an email message will look something like this:

Received: from antivirus1.its.rochester.edu (antivirus1.its.rochester.edu [128.151.57.50])
        by mail.rochester.edu (8.12.8/8.12.4) with ESMTP id h2OGQs9o002563;
        Mon, 24 Mar 2003 11:26:54 -0500 (EST)
Received: from antivirus1.its.rochester.edu (localhost [127.0.0.1])
        by antivirus1.its.rochester.edu (8.12.8/8.12.4) with ESMTP id h2OGQrQx003450;
        Mon, 24 Mar 2003 11:26:54 -0500 (EST)
Received: from galileo.cc.rochester.edu (galileo.cc.rochester.edu [128.151.224.6])
        by antivirus1.its.rochester.edu (8.12.8/8.12.4) with SMTP id h2OGQrDC003447;
        Mon, 24 Mar 2003 11:26:53 -0500 (EST)
Received: (from majord@localhost)
        by galileo.cc.rochester.edu (8.12.8/8.12.4) id h2OGQq91029757;
	Mon, 24 Mar 2003 11:26:52 -0500 (EST)
Date: Mon, 24 Mar 2003 11:26:50 -0500 (EST)
From: somesender@mail.rochester.edu
Message-Id: <200303241626.h2OGQojt002507@mail.rochester.edu>
To: someuser@its.rochester.edu
Subject: My mail message is about a topic

This data of where the message has actually come from can be very valuable in tracking down the real origin of an email. Email can be forged fairly easily, but every email will always be marked with the true IP address of the sending host. The trick is in getting your email client to display these lines so that you can analyze them yourself or forward them on to your support staff.

A full header does NOT look this this:

------------Example Incomplete Header------------
Date: Fri, 29 May 03 08:53:48 EST
From: MyFriend@friendly.com
Subject: NEW! 600K Hot List... No AOL
Reply-To: yourfriend@nowhere.com
----------End Example Incomplete Header----------

The following list of email clients and applicable modes of header display were borrowed from http://www.owlriver.com.

How to display the full headers in various email programs:

Netscape 4.x for PC / MAC:

1. Select the message in question.
2. Double-click on the mail message to open it.
3. Click on the "View" option on the main toolbar, then select "Header," and then "Full."

1. Select the message in question.
2. Click on the "Options" option in the main toolbar, then select "Show Headers," and then the "All."

1. Open message in Full-View (you double-click on the message in the "Message Listing" pane.)
2. Left-click on the "View" menu and select "Options".

1. Select the message in question.
2. Click on the "File" menu and select "Properties".
3. Click on the "Details" tab on the top of the window.

1. Select the message in question.
2. Double-click on the message to open it.
3. Find the message button bar.  This is not the main toolbar, but the button bar immediately above the message text pane of the message viewer.
4. Click on the "Blah Blah Blah" button on this toolbar.

1. Select the message in question.
2. Click on the "View" option on the main toolbar.
3. Select the "Show Internet Headers" option.

1. Click on "Edit" on the main toolbar.
2. Select "Preferences."
3. Click on the "Display" option on the left-hand pane of the "Preferences" menu.
4. Click on the checkbox next to "Show message headers in message windows."

1. Select the message in question.
2. Double-click on the message to open it.
3. Find  the message button bar.  This is not the main toolbar, but the button bar immediately above the message text pane of the message viewer.
4. Click on the "Blah Blah Blah" button on this toolbar.

1. Click on "File" on the main toolbar.
2. Select "Preferences," and the suboption "General Preferences."
3. Click on the checkbox "Show all headers when reading messages."

1. Enable the full header command. (NOTE: This step only needs to be done once. The change is permanent.)
   1. Type 's' for Setup
   2. Type 'c' for Config.
   3. Scroll down the list of features until you find enable-full-header-cmd, and type 'x' until you see an 'X' in the checkbox.
   4. Type 'e' to Exit.
   5. Answer with yes (by hitting 'y') when it asks you to replace settings.
2. Select the message in question.
3. Press the [Enter] key to view it.
4. Press 'h' to display the full header.

• http://www.stopspam.org/email/headers/headers.html
• http://spamcop.net/fom-serve/cache/19.html"

Problems or questions? Please contact the ITS Center at x5-2000 or email:

Text | Directory | Index | Contact | Calendar | News | Giving

©Copyright 1999 -- 2006 University of Rochester