View full headers in Gmail

In Gmail on a computer, open the message, click the More button (three vertical dots) next to Reply, and choose Show original. The full message opens in a new browser tab; click Copy to clipboard and paste the result into the analyser. The Gmail apps for Android and iPhone don't have this option, so you need a browser.

Steps (Gmail on the web)

1. Go to Gmail in a desktop browser and open the message you want to check.
2. In the message's own header area, find Reply (the curved arrow) and click the More button (⋮) beside it.
3. Choose Show original.
4. A new tab opens with the original message. Click Copy to clipboard.
5. Paste it into the analyser.

These steps match Google's help article Trace an email with its full header. Google changes Gmail's layout from time to time; if the menu looks different, look for the three-dot menu that belongs to the individual message (not the one in the toolbar above the whole conversation) and find an item mentioning original.

What you'll see

The "Show original" tab has two parts.

At the top is a short summary box that Gmail fills in from the headers: the Message ID, when the message was created, who it's from and to, the subject, and Gmail's verdict for SPF, DKIM and DMARC, usually with the domain and IP address that were checked. It's a handy first look, but it is Gmail's summary, not the headers themselves.

Below that is the message as Gmail received it, in plain monospace text. It begins with the header section (lots of Received:, ARC- and Authentication-Results: lines, then From:, To:, Subject: and the rest) and, after a blank line, the body (RFC 5322 §2.1). The body is often a wall of encoded text; that's normal.

The lines at the top were added by Google's servers, so the first few headers you see describe the last hop into your mailbox. Read the Received headers guide for how to follow them back to the sender.

Copying it

The Copy to clipboard button copies the whole original, body included. That's fine: the analyser stops at the end of the header section and ignores the body.

If you prefer to select by hand, click anywhere in the text and press Ctrl+A (Windows, Linux, ChromeOS) or Cmd+A (Mac), then copy. On this page Ctrl+A also selects the summary box, which is harmless, but Copy to clipboard is cleaner.

On the same page there's also a link to download the original as a file. Google also documents a separate route: More → Download message in the message itself, which saves an .eml file (Download & send emails as attachments). You can open an .eml file in a text editor and copy the headers from there.

Google Workspace accounts

Work and school accounts on Google Workspace use the same Gmail interface, so More → Show original works the same way. You'll typically see more internal hops in the Received: chain if your organization routes mail through other systems (a security gateway, for instance) before or after Gmail.

If a message never arrived at all, headers can't help, because there's no message to read. Workspace administrators have a separate tool, Email Log Search in the Admin console, for tracing those (Find messages with Email Log Search).

The Gmail apps (Android, iPhone, iPad)

Google's help documents "Show original" only for Gmail on a computer, and the Android and iOS apps don't have it. Expanding the sender details in the app shows the from and to addresses, the date and a short security note, but not the raw headers.

Your options on a phone are limited and none of them is as easy as using a computer. The phone guide covers what works and what doesn't.

Common snags

• Nothing happens when you click Show original. It opens a new tab, so a strict popup blocker or an extension can stop it. Allow popups for mail.google.com and try again.
• You picked the wrong message in a thread. In a conversation, each message has its own ⋮ menu. Make sure you open the menu on the message you actually want to analyse, usually the one from the suspicious sender, not your own reply.
• "Show original" isn't in the menu. Check you're using the menu next to Reply inside the message, not the one at the top of the page, and that you're in a desktop browser. Some third-party Gmail clients and the mobile web view don't offer it.
• Gmail's summary disagrees with the analyser. Gmail's box shows Gmail's own verdict. The analyser reads the Authentication-Results: lines the same servers wrote, so the SPF, DKIM and DMARC results should match. Differences usually come from alignment checks (see DMARC alignment) or from extra headers added by forwarding.
• You're looking at a message you sent. The copy in Sent Mail has hardly any routing headers, because it never travelled to you. Ask the recipient for theirs instead.

Next

Paste what you copied into the analyser. To make sense of the result, these help most:

• Authentication-Results explained: what Gmail's spf=, dkim= and dmarc= entries mean.
• Received headers: how to follow the route back to the sender.
• How to spot phishing from headers: the checks worth doing on a suspicious message.