How to view full email headers

Every mail app can show you the full headers of a message, but each one calls them something different and hides them in a different menu: Gmail says Show original, Outlook says View message details or Internet headers, Apple Mail and iCloud say All Headers, Thunderbird says Message Source, Yahoo says View Raw Message. Find the right item for your app in the table below, copy everything it shows you, and paste it into the analyser.

What "full headers" means

An email has two parts: a header section and a body. The header section is a block of Name: value lines at the very top of the message, and the body starts after the first completely empty line (RFC 5322 §2.1). When your mail app shows you a tidy "From", "To" and "Subject" bar, it is picking three or four of those lines and hiding the rest.

The hidden lines are the useful ones. Each mail server that handles a message adds a Received: line to the top of the header section and is not allowed to remove or reorder the ones already there (RFC 5321 §4.4), so reading them from the bottom up gives you the route the message took. The receiving server also writes Authentication-Results:, which records whether SPF, DKIM and DMARC passed. None of that is visible in the normal view.

Different apps use different names for the same thing:

• Full headers / all headers / internet headers: the header section only.
• Original message / message source / raw message / raw source: the whole message exactly as it arrived, headers first, then the body (often in encoded form).

Either is fine for analysis. The source view is usually better, because some "all headers" views reformat or drop lines.

Why the pretty From line is not enough

The From name and address you see in your inbox are just text the sender typed. Anyone can put any name in there, and with a little effort any address too. What a forger cannot easily fake is what your provider's servers recorded when the message arrived: the IP address that connected, the name it gave, and the authentication results. Those live only in the full headers. That is why every guide to spotting phishing from headers starts with "get the raw headers first".

Where to find them

Vendors move these items around. If yours doesn't match, look in the message's own "more" or "…" menu (not the inbox toolbar) for words like original, source, raw, details or headers.

What to copy

Copy everything from the very first line down to the first blank line. That is the complete header section. In practice it usually starts with a Received:, Delivered-To:, Return-Path: or ARC-Seal: line and ends somewhere after Subject:, Date: and MIME-Version:.

You don't have to find that blank line yourself. Copying the whole source, body and all, is fine: the analyser reads up to the first empty line and ignores the rest. In most source views the quickest way is to click inside the text and press Ctrl+A then Ctrl+C (Cmd+A, Cmd+C on a Mac).

A few things to keep intact:

• Don't retype anything. Long header lines are wrapped over several lines, with each continuation line starting with a space or tab (RFC 5322 §2.2.3). The analyser joins them back together, but only if the indentation survives. Copy and paste; don't reconstruct.
• Copy the recipient's copy. Headers on the copy in your Sent folder say very little, because the message never crossed the internet to reach that folder. To analyse a message someone sent you, open it in your inbox.
• Avoid an ordinary forward. Clicking Forward creates a brand-new message with your own headers; the original routing is gone. If someone else needs to look at a message, either paste its headers to them or use "forward as attachment", which keeps the original intact (see the Gmail guide for one way to do it).

A minimal header section looks something like this:

Received: from mail.example.net (mail.example.net [198.51.100.25])
        by mx.example.com with ESMTPS id 4Xk2Lp0Zq9z1
        for <you@example.com>; Mon, 26 Oct 2026 09:14:03 +0000
Authentication-Results: mx.example.com;
       spf=pass smtp.mailfrom=example.net;
       dkim=pass header.d=example.net;
       dmarc=pass header.from=example.net
From: "Example Support" <support@example.net>
To: you@example.com
Subject: Your order has shipped
Date: Mon, 26 Oct 2026 09:13:58 +0000
Message-ID: <20261026091358.ab12@mail.example.net>

Real ones are usually much longer: a big provider can add twenty or more lines of its own. To learn what each part means, start with Received headers and Authentication-Results.

A word on privacy

Headers are not anonymous. They contain your email address, often your name, the IP addresses of every server along the way, and sometimes internal hostnames or the sender's own IP. For mail sent between colleagues, they can reveal the names of company servers.

That is why MailDingo does all of its work in your browser. Nothing you paste is uploaded or stored; the page's security policy forbids it from sending your data anywhere. If you want to share headers with someone else, for example a help desk, check what you're sending first and remove anything you don't want to give away. If you do edit them, keep a clean copy for your own analysis, because edited headers can no longer be checked properly.

Tip: If a message looks like phishing, report it through your mail app's own "report phishing" or "junk" button as well. Your provider learns from those reports; it can't learn from an analysis you run in your browser.