Learning to read email headers is a skill used when trying to determine the path an email follows from the sender to the recipient. This skill can be applied in several facets, from helping an email provider recognize spam emails to aiding in recognizing a scam or virus delivered by email. In this article we teach you how to open your email headers, as well as how to analyze them to learn more about the message and if it's trustworthy.
How to View and Read Email Headers
First, open the email header by clicking the three-dot menu on the email and choosing Show original / View message details / View headers . You can paste the message header into an analyzer to view it more easily if you prefer. Check for a "PASS" on SPF, DKIM, and DMARC to ensure the email is trustworthy.
Steps
-
1Open the email you want to view the header of. You can view email headers in any major email provider, such as Gmail, Outlook, Yahoo Mail, and Proton Mail.
-
2Open the email header. How you do this varies depending on what email provider you're using:
- Gmail:
Click the â‹®
button next to the reply arrow, then click Show original
. The interpreted email header will be shown at the top of the page, with the full email header underneath it. [1]
X
Research source
- Click Copy to clipboard to copy the email header.
- Classic Outlook: Click File > Properties and check the "Internet headers" box. [2] X Trustworthy Source Microsoft Support Technical support and product information from Microsoft. Go to source
- Web Outlook: Click the ••• button next to the forward and reply arrows, then click View > View message details . [3] X Trustworthy Source Microsoft Support Technical support and product information from Microsoft. Go to source
- New Outlook: Click the ••• button at the top of the message, then click View > View message details . [4] X Trustworthy Source Microsoft Support Technical support and product information from Microsoft. Go to source
- Yahoo Mail: Click the ••• button and click View Raw Message . [5] X Research source
- Proton Mail: Click the ••• button next to the trash can button, then click View headers . [6] X Research source
Advertisement - Gmail:
Click the â‹®
button next to the reply arrow, then click Show original
. The interpreted email header will be shown at the top of the page, with the full email header underneath it. [1]
X
Research source
-
3Use an email header analyzer (optional). While you can simply scroll through your email header to find information, it's much easier to use an email header analyzer. There are a number of options available, but this analyzer is easy to use and displays the most information of all the websites we found.
-
1Check an email's authenticity with SPF, DKIM, and DMARC. SPF (or Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting & Conformance) are headers that can help you identify if an email is spam, or if you can trust the sender. SPF and DKIM are required for all emails, and DMARC is required for senders that send bulk emails (or over 5,000 emails per day). [7] X Research source
- If the email headers for SPF, DKIM, and DMARC all say "PASS," the email has been authenticated and can be trusted. If any of these say "FAIL," do not interact with the email and report it to your email provider.
-
2Search for the term "Precedence". If you see the "Precedence" header, that means the sender marked their email as bulk, which keeps the message from being sent to your spam folder. You might see this on marketing emails or newsletters to improve inbox placement. [8] X Research source
-
Determine who sent the email by looking at the "Received" tags. Because email headers are listed in reverse chronological order, the bottom header will provide you with information about the original sender. You can learn the sender's email address, the date and time that the message was sent, as well as server and domain information, such as their IP address.
- This is helpful if you're trying to identify spam email or if you're getting email from an unwanted sender.
- You can use a website like WhatIsMyIPAddress to look up the sender's IP.
-
Learn if there was a server lag. The "Received" tag will tell you when your email server received the message. If this happened a long time before you saw the message arrive in your inbox, there may be an issue with your server. Contact your Internet Service Provider or network administrator if this happens frequently.
-
Determine information about the sender's email provider. The "Received: from" and "Message ID" tags reference information about the sender's email provider, such as the server, date, time, and method.
-
6Check if the email was sent to more than one person. In the "To" field, see if there are other emails listed. If so, you'll be able to see if the sender sent this email to a number of people, or if they only sent it to you.
-
7See if you were blind carbon copied on an email. Search the header to see if you were blind carbon copied (Bcc'd) on an email. This is typical when an email is sent to a large group of people.
- You may also see that the email was sent to "undisclosed-recipients." If this is the case, you won't be able to see everyone that the email was sent to.
Community Q&A
-
QuestionWhat does the X stand for?Community AnswerX is just something placed there by the server.
Video
Tips
- Read email headers before marking a message as spam. This will help avoid blacklisting where unnecessary.Thanks
- If given the option to unsubscribe, choose to do that rather than mark a message as spam. Spam filters are designed to be trained, and may categorize newsletters you wish to read as spam if you do not do this.Thanks
References
- ↑ https://support.google.com/mail/answer/29436?hl=en
- ↑ https://support.microsoft.com/en-us/office/view-internet-message-headers-in-outlook-cd039382-dc6e-4264-ac74-c048563d212c#tab=classic_outlook
- ↑ https://support.microsoft.com/en-us/office/view-internet-message-headers-in-outlook-cd039382-dc6e-4264-ac74-c048563d212c#tab=web
- ↑ https://support.microsoft.com/en-us/office/view-internet-message-headers-in-outlook-cd039382-dc6e-4264-ac74-c048563d212c#tab=new_outlook
- ↑ https://help.yahoo.com/kb/SLN28478.html
- ↑ https://proton.me/support/check-email-headers
- ↑ https://www.mailercheck.com/articles/guide-to-email-authentication-types
- ↑ https://www.mailercheck.com/articles/how-to-read-and-understand-email-headers