Interpreting Email Headers
If you have contacted support for help with a spam or other email-related issue, you may have been asked to provide full header information for the email in question.
What is a full header?
Full headers are more than the "From" and "To" lines your email client displays at the top of your email messages. The full headers contain a lot of information, including every hop a message has taken across the Internet to get from its sender to you, its final recipient. This data of where the message has actually come from can be very valuable in tracking down the real origin of an email. Email can be forged fairly easily, but every email will always be marked with the true IP address of the sending computer. The trick is getting your email client to display these lines so that you can analyze them yourself or forward them to your support staff.
Full email headers look something like this:
Received: from antivirus1.its.rochester.edu (antivirus1.its.rochester.edu [128.151.57.50])
by mail.rochester.edu (8.12.8/8.12.4) with ESMTP id h2OGQs9o002563;
Mon, 24 Mar 2003 11:26:54 -0500 (EST)
Received: from antivirus1.its.rochester.edu (localhost [127.0.0.1])
by antivirus1.its.rochester.edu (8.12.8/8.12.4) with ESMTP id h2OGQrQx003450;
Mon, 24 Mar 2003 11:26:54 -0500 (EST)
Received: from galileo.cc.rochester.edu (galileo.cc.rochester.edu [128.151.224.6])
by antivirus1.its.rochester.edu (8.12.8/8.12.4) with SMTP id h2OGQrDC003447;
Mon, 24 Mar 2003 11:26:53 -0500 (EST)
Received: (from majord@localhost)
by galileo.cc.rochester.edu (8.12.8/8.12.4) id h2OGQq91029757;
Mon, 24 Mar 2003 11:26:52 -0500 (EST)
Date: Mon, 24 Mar 2003 11:26:50 -0500 (EST)
From: somesender@mail.rochester.edu
Message-Id: <200303241626.h2OGQojt002507@mail.rochester.edu>
To: someuser@its.rochester.edu
Subject: My mail message is about:
A full header does NOT look like this:
------------Example Incomplete Header------------
Date: Fri, 29 May 03 08:53:48 EST
From: MyFriend@friendly.com
Subject: NEW! 600K Hot List... No AOL
Reply-To: yourfriend@nowhere.com
----------End Example Incomplete Header----------
How to display the full headers in various email programs
Office 365 via Outlook Web Access
- Double click the message in your inbox to open it.
- On the top menu you will see buttons for delete, reply, reply all, forward. On the same menu is a button that is a series of dots (...)
- Click the dots and choose "View Message Details."
Outlook 2007/2010
- Double click the message in your inbox to open it.
- From the File menu, chose Properties.
- The headers will be displayed on the Internet Headers section of the Properties window that appears.
Outlook 2011 for Mac
- From your inbox, right click the message and choose View Source.
- The headers will be opened in TextEdit.
Apple Mail
- Double click the message in your inbox to open it.
- From the View menu, select Message and then All Headers.
- The headers will be displayed at the top of the message.
Zimbra
- From your inbox, right click the message and chose Show Original.
- The headers will be displayed.
Gmail
- Open the message.
- Click the small downward facing arrow next to the Reply button at the top right of the message.
- Select Show Original and the headers will appear in a new window.
Outlook 2003
- Double click the message in your inbox to open it.
- From the View menu, chose Options.
- The headers will be displayed on the Internet Headers section of the window that appears.
Outlook Express/Windows Mail
- Double click the message in your inbox to open it.
- From the File menu, chose Properties.
- Click the Details tab to view the full headers.
