View full headers in Apple Mail

In Mail on a Mac, select the message and choose View → Message → All Headers from the menu bar. The full header section appears at the top of the message. On iCloud Mail on the web, open the message, click the More button and choose Show All Headers. Copy what appears and paste it into the analyser. The Mail app on iPhone and iPad can't show full headers; see the phone guide.

Mail on Mac: show all headers

1. Open Mail and click the message once so it shows in the reading pane (or double-click it to open it in its own window).
2. In the menu bar, choose View → Message → All Headers.
3. The header area above the message body grows into the complete list of header lines.
4. Select from the first header line down to the last one before the body, copy with Cmd+C, and paste into the analyser.
5. To go back to the short view, choose View → Message → Default Headers.

This is the path in Apple's guide, Show detailed headers in Mail on Mac. Apple rearranges Mail's menus between macOS releases; if your View menu looks different, look for a Message submenu or an item mentioning headers.

Selection quirk: in this view the headers sit right above the body in the same pane, so dragging to select can easily run into the message text. That's harmless (the analyser ignores everything after the header section), but you do need to start the selection on the very first header line. Make sure you haven't missed lines at the top; the first ones are usually Received: or Return-Path:.

Watch out: All Headers displays the headers in a formatted, readable way. Long lines that the sender wrapped (RFC 5322 §2.2.3) may be shown differently from the original text. For a faithful copy, use the raw source below.

Mail on Mac: raw source

Mail also has a raw-source view that shows the whole message exactly as received. In current and recent versions of Mail it's at View → Message → Raw Source, with the keyboard shortcut Option-Cmd-U. We could not confirm this on Apple's own support pages, which don't currently document the item, so treat it as "should be there" rather than guaranteed.

If it's there, it opens the message source in a separate window. Click in it, press Cmd+A, then Cmd+C. That copies body and all, which is fine: the analyser reads up to the first blank line, where the header section ends (RFC 5322 §2.1), and stops.

Save as a file instead. Apple does document a related option: select the message, choose File → Save As, and pick Raw Message Source as the format. That saves the message as an .eml file (Save emails as files or PDFs in Mail on Mac). Open the .eml file in TextEdit (right-click → Open With → TextEdit) and copy the headers from there. Double-clicking an .eml file usually opens it back in Mail, which isn't what you want here.

Show extra fields every time

If you only want one or two extra lines (say, Reply-To or List-ID) on every message without switching to All Headers, Mail lets you add custom fields to the default header view in Mail → Settings → Viewing. Apple's guide mentions this option. It won't give you the routing and authentication lines in full, so for analysis you still want All Headers or Raw Source.

iCloud Mail on the web

1. Go to icloud.com/mail in a browser and sign in.
2. Open the message.
3. Click the More button at the top of the message and choose Show All Headers.
4. Select the header text, copy, and paste into the analyser.
5. To switch back, use More → Show Default Headers.

That's Apple's documented path (View all email headers in Mail on iCloud.com). Some regional copies of the page describe the button differently (the reply/forward menu instead of More), so if you don't see More, try that menu. Apple's page covers only the headers view; it doesn't document a raw source option for iCloud Mail on the web.

Apple's guide adds that a checkmark in the header area means the message was digitally signed and the signature checked out. That refers to S/MIME signatures, which most mail doesn't have; it's separate from the SPF, DKIM and DMARC checks the analyser explains.

Common snags

• The menu items are greyed out. Click a single message first; with nothing selected, message-specific items stay disabled.
• All Headers seems to be stuck on. Mail remembers the choice. Use View → Message → Default Headers to turn it off.
• You copied from a message you sent. Sent copies have hardly any routing headers. Analyse a message that arrived in your inbox.
• On iPhone or iPad. Mail for iOS and iPadOS has no headers view. Use icloud.com in a browser for iCloud addresses, or a computer. The phone guide has the options.

Next

Paste the headers into the analyser. Then:

• Received headers explains how to read the hops from the bottom up.
• Authentication-Results covers the SPF, DKIM and DMARC lines iCloud and other providers add.
• How to spot phishing from headers walks through the checks worth doing on a suspicious message.