Norwegian version of this page

How to find the headers in an email

An e-mail contains a lot more headers than what your e-mail program of choice usually displays. In these headers you can find a lot of useful information about the origin of the e-mail. The following guides show how to find all the headers for the different types of email providers.

Webmail (OWA)

Showing all the headers in Webmail

  • Click on the e-mail that you wish to show the headers for and click on three dots on the top right corner (next to Reply, Reply all and Forward).

webmailExample

  • Click on "view message details" in the dropdown menu.

Bildet kan inneholde: rektangel, font, parallell, elektronisk apparat, skjermdump.

  •   The "message details" window is opened and you can read and copy the headers and paste them into a document or an e-mail.

Thunderbird

Windows

  1. Open Thunderbird.
  2. Open the menu in Thunderbird in the upper righthand corner.
    Thunderbird1
  3. Click on View > Headers > All.
    Thunderbird2
  4. Forward the email. The email should now contain all the headers.
  5. Turn off viewing of all headers by clicking View > Headers > Normal in the menu in the top righthand corner.

Mac

  1. Choose the message you wish to find a heading for in Thunderbird.

  2. From the top menu, choose View > Headers > All.

  3. Forward the email. It should now contain all headers.

  4. Turn off viewing of all headers by clicking View > Headers > Normal.

Pine

Showing all the headers in Pine

  • In order to see all the headers in a message, click "h".

Forwarding a message in Pine with all headers included

  • Show all headers as explained above. Forward the e-mail by clicking "F". Pine will then ask you if you wish to forward the e-mail as an attachment. Answer yes.

Outlook

Showing all headers in Outlook

  • Outlook 2010 or newer

Windows

  1. Open the message in a separate window by double-clicking on the message from the message list.
  2. Click on ?File? and then ?Properties?.
  3. Headers are shown in the ?Internet headers?.Open the needed email and click on the File optionClick on the Properties button

Forwarding a message in Outlook with all headers included

  • Outlook 2010: Select or open an email. Choose ?More? and then ?Forward as Attachment?.
    NB! Outlook 2016 deletes some of the headers when done this way, so it's better to copy all the headers into an email.

    Mac

    1. In the email list, right-click on the message.
    2. In the drop-down menu, click on ?View Source?. A text document containing all the headers from the email should pop up.
      Mac Outlook

    Forward an email in Outlook with all headers included

    • Microsoft Outlook: In the same drop-down menu, choose ?Forward as Attachment?.

    Gnus

    Showing all headers in Gnus

    • In the email you're looking at - click ?Ctrl-u g?.

    Forwarding the email you are looking at, with headers included

    • Click ?S o M?.

    Apple Mail

    1. Select an email in Apple Mail.
    2. Choose ?View?, ?Message? and then ?All Headers?. You can also use the keyboard command ?Shift+Cmd+H?.Apple Mail View drop-down menu with Message > All Headers highlighted
    3. Forward the email as usual.
    4. Turn off the viewing of all headers by repeating the previous command: ?View?, ?Message? og s? ?All Headers? (or ?Shift-Cmd-H?)

    Gmail

    View all headers in Gmail

    • Click on the email you want to get the header for. Click on the three dots in the upper corner (next to the answer arrow).

    Bildet kan inneholde: rektangel, font, parallell, sirkel, antall.

    • In the dropdown menu, choose "view the original".

    Bildet kan inneholde: font, parallell.

    • The original email will be opened in a new window and you can read and copy the headers in order to paste them into a new email. Click on "Copy to clipboard" in the new window.

    Example of a header:

    Return-Path: 
     Received: from mail-imap2.uio.no ([unix socket])
     	 by mail-imap2.uio.no (Cyrus v2.2.12) with LMTPA;
     	 Tue, 29 Sep 2009 06:59:25 +0200
     X-Sieve: CMU Sieve 2.2
     Delivery-date: Tue, 29 Sep 2009 06:59:25 +0200
     Received: from mail-mx2.uio.no ([129.240.10.30])
     	by mail-imap2.uio.no with esmtp (Exim 4.69)
     	(envelope-from )
     	id 1MsUo9-0003Jj-7V
     	for bca@ulrik.uio.no; Tue, 29 Sep 2009 06:59:25 +0200
     Received: from lister.uio.no ([129.240.12.12])
     	by mail-mx2.uio.no with esmtp  (Exim 4.69)
     	(envelope-from )
     	id 1MsUo8-00060f-ON; Tue, 29 Sep 2009 06:59:25 +0200
     Received: from lister.uio.no ([129.240.12.12])
     	by lister.uio.no with esmtp (Exim 4.43)
     	id 1MsUo8-0005Tz-Ao; Tue, 29 Sep 2009 06:59:24 +0200
     Received: from mail-mx1.uio.no ([129.240.10.29])
     	by lister.uio.no with esmtp (Exim 4.43)
     	id 1MsUo6-0005TI-MD
     	for postmaster@uio.no; Tue, 29 Sep 2009 06:59:22 +0200
     Received: from web82605.mail.mud.yahoo.com ([68.142.201.122])
     	by mail-mx1.uio.no with smtp  (Exim 4.69)
     	(envelope-from )
     	id 1MsUo2-0006CL-QZ
     	for postmaster@uio.no; Tue, 29 Sep 2009 06:59:22 +0200
     Received: (qmail 91065 invoked by uid 60001); 29 Sep 2009 04:59:17 -0000
     DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
       s=s1024; d=sbcglobal.net;
       h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
       b=oOnRKZDz964TmKLxDSjRCzf4z4mDUBoW4ujriMPeAfsz1TlbVBQ2QiwUq76H5Hpoe9ccL18h7OUuVf59lNYw+zerV4yQPMEPtDGSNP6PlnYvMJgtcaG2G/Y92POXsUCT06jBTCItCvfHLxZeOTWpK3S0B8jS8suTkAgDP0YzUhY=;
     Message-ID: <621852.87957.qm@web82605.mail.mud.yahoo.com>
     X-YMail-OSG: 6wnviz4VM1lTpLCF_Dcfz_VD3KrG1z_dmmgZZRR5.Hbnfls3Ti839xfNtBqlFDexgBhSJjQ9B0Qvg7acrjIKJHJLxvfPSlaxC6f9tZTwKZCkBoYttDyzrwyiOPHu0bhj4K1uhWeAWYInfQ.BD3RknQygIymUshPOoYEp5WEvdX0RwjH6_BqxE1MzT2_rwTt1hBDlcchyWEEnSjw7GqhXD4Vo0bC_vSpanVzyLci9axuimbf04p79iGgJ0a9vOXYJbUPg5fCm5YMhrWsxVbxQbLgx6VwkKNFYWzoFJc.nAcWqQKg36W2X2kZtzy_TPQPd0KXUrqUr0ZVvvPQ_4aXtN681cMQHMD9tcERT4VFjz.x5bX_nHaV0C7ddBPKjkVcq0b3j_JF79nm_k7t77BVF.azn_OoCTiXVGnI5MKK6TWuRvl3rPvOdjG1HxMLhv8XogYFwhjS1Ys5RtmnlUocvNVeoTL.O.TOFJcKV6cw6F4AFKBU5fwz..N.8G9rD2YtCnGm2hEBD6a6MZsU.uxQ4_wcnSd1MtQFNCRDdeg2Tb__.dFD1WprIOLKkn4W6BNk-
     Received: from [62.56.141.14] by web82605.mail.mud.yahoo.com via HTTP; Mon, 28 Sep 2009 21:59:17 PDT
     X-Mailer: YahooMailClassic/7.0.14 YahooMailWebService/0.7.347.3
     Date: Mon, 28 Sep 2009 21:59:17 -0700 (PDT)
     From: WEBMAIL MAIL SPAM ALERT 
     Reply-To: webmail_engineeringoffice@yahoo.ca
     Subject: WEBMAIL ADMIN MENTAINANCE
     To: undisclosed recipients: ;
     MIME-Version: 1.0
     Content-Type: multipart/alternative; boundary="0-589803631-1254200357=:87957"
     X-UiO-MailScanner: No virus found
     X-UiO-Spam-info: not spam, SpamAssassin (score=4.0, required=5.0, autolearn=disabled, HTML_MESSAGE=0.001,RCVD_IN_BL_SPAMCOP_NET=2.188,SUBJ_ALL_CAPS=1.806, uiobl=NO, uiouri=NO)
     X-UiO-Spam-Score: ssss
     X-UiO-Scanned: 4E65F863B311135E0357AF6E194018A9F18D4726
     Sender: postmaster-owner@usit.uio.no
     Errors-To: postmaster-owner@usit.uio.no
     X-BeenThere: postmaster@usit.uio.no
     X-Mailman-Version: 1.2 (experimental)
     Precedence: bulk
     List-Id: Postmasters @ UiO <postmaster.usit.uio.no>
    

     

    Tags: headere, headers, phishing, spam, cert, headere
    Published July 12, 2024 2:45 PM - Last modified July 12, 2024 2:53 PM