How to View Email Headers

Overview

Every email you receive is really two things stacked together: the headers and the body. The body is the part you normally see — the subject line's content, the message text, any attachments. The headers are metadata that travels with the message but isn't shown by default: which servers relayed it, what authentication checks it passed or failed (SPF, DKIM, DMARC), the exact From/Reply-To/Return-Path addresses, and a unique Message-ID.

Your mail client already reads these headers to decide things like whether to show a "this sender looks suspicious" warning — but it only shows you a small, simplified summary. Viewing the raw headers directly is how you see the full picture: useful when a message that should be authenticated shows up as suspicious, when diagnosing why legitimate email is landing in spam, or when investigating a possible spoofing attempt.

Why it happens

Raw email headers are not anonymous. Depending on the message, they can include the sender's real email address and display name, internal server hostnames and IP addresses (both the sending server's and, for mailing lists or forwarded mail, intermediate relays), a unique Message-ID that can sometimes be used to correlate activity, and occasionally internal routing details from corporate mail systems.

Treat a full header dump the same way you'd treat a screenshot of your inbox: fine to review yourself or share privately with someone you trust (e.g. your IT admin, or pasted into MXFend's Email Header Analyzer, which never stores what you paste), but think twice before posting raw headers in a public forum, a public bug tracker, or a public support ticket. If you do need to share them publicly, redact IP addresses and email addresses you don't want exposed first.

How to fix it

Once you have the raw header text (see the sections below for exactly where to find it in each client), the fastest way to make sense of it is MXFend's free Email Header Analyzer: paste the full header block in, and it parses SPF, DKIM, DMARC, and ARC results, shows the routing path server-by-server, and flags common problems (missing authentication, alignment failures, suspicious Return-Path/From mismatches) in plain language — no need to manually decode each header line yourself.

What to copy

You want the complete raw header block, not just one or two lines. In every client below, once you reach the raw-headers view, select all of the text in that view (Ctrl/Cmd+A works in most of them) and copy it — it typically starts with a line like "Delivered-To:" or "Return-Path:" and ends right before the message body begins. A partial copy (e.g. only the visible portion of a scrollable box) will cut off headers that come later, such as the DKIM signature or the full chain of Received lines, so scroll to select everything before copying if the box doesn't select-all its full contents at once.

Gmail (web)

Open the message. Click the three-dot “More” menu in the top-right corner of the open message (not the inbox list). Choose “Show original”. Gmail opens a new tab with the full raw headers followed by the message body — there's also a “Copy to clipboard” button at the top of that page that copies the whole thing in one click.

Outlook on the web (Outlook.com / Microsoft 365)

Open the message. Click the three-dot “...” menu above the reading pane. Choose “View”, then “View message details” (older layouts may show this directly as “View message source”). This opens a panel or new window containing the raw Internet headers — select all and copy from there.

Outlook desktop (Windows)

Double-click the message to open it in its own window (headers aren't accessible from the reading pane). Go to File → Info, then click “Properties”. The “Internet headers” box near the bottom of the Properties dialog contains the raw headers — click inside the box, select all, and copy. On newer ribbon versions, the same option is under the “...” (More actions) menu → “View message details”.

Apple Mail (macOS)

Open the message. From the menu bar, choose View → Message → All Headers to see the headers inline above the message body, or View → Message → Raw Source to see the completely unprocessed original (headers plus body, exactly as received). Either view can be selected and copied normally.

A note on mobile apps

The Gmail and Outlook mobile apps generally don't expose raw headers directly — the reliable path on a phone or tablet is to open the same mailbox in a browser (or forward the message to yourself as an attachment from a desktop client) and use the web instructions above.