View full headers in Thunderbird

In Thunderbird, select a message and press Ctrl+U (Cmd+U on a Mac), or choose View → Message Source from the menu bar. The raw message opens in its own window; press Ctrl+A, copy, and paste into the analyser. If you'd rather see the headers above the message itself, use View → Headers → All.

Which view to use

Thunderbird gives you two ways in, and they're not the same:

• Message Source shows the message exactly as the server stored it: every header line in its original order and wrapping, then a blank line, then the body (RFC 5322 §2.1). This is the one to copy for analysis.
• Headers → All expands the header pane above the message to list every field. It's convenient for a quick look, but Thunderbird lays the fields out for reading, which can unwrap long lines (RFC 5322 §2.2.3) and change their look. Copying from it is fiddly too.

So: use Message Source to copy, use Headers → All to glance.

Steps: Message Source

1. Click the message in the message list (or open it).
2. Do one of these: - press Ctrl+U (Windows, Linux) or Cmd+U (Mac); - choose View → Message Source from the menu bar; - in the header area of the message, click More and choose View Source.
3. A new window (or tab, depending on your settings) shows the raw message.
4. Click anywhere in it, press Ctrl+A (Cmd+A), then Ctrl+C (Cmd+C).
5. Paste into the analyser.

You'll get the body too. That's fine: the analyser stops at the first blank line.

Steps: show all headers inline

1. Select the message.
2. Choose View → Headers → All.
3. The header pane above the message now lists every header field.
4. To go back, choose View → Headers → Normal.

The setting sticks until you change it, and applies to every message you open.

Can't see a View menu?

Recent Thunderbird versions hide the classic menu bar by default and use the ≡ application menu instead. On Windows and Linux, press Alt once and the menu bar appears temporarily, with View in it. To keep it, right-click an empty part of the toolbar area and turn on Menu Bar. On a Mac the menu bar is always at the top of the screen.

The keyboard shortcut works whether the menu bar is visible or not, as long as a message is selected and the focus is on the message list or message pane. (In the compose window, Ctrl+U means underline, so it won't open anything there.)

Thunderbird's menus shift between releases. If yours differ, look for Source or Headers under View, or in the More button on the message. (Mozilla's help site would not load while we checked this page, so the labels above were confirmed against Thunderbird's own English interface text rather than a help article.)

What you'll see

The source window is plain monospace text. Near the top are the lines your own mail provider added, usually a Return-Path:, one or more Received: lines and Authentication-Results:. Further down come the sender's own lines like From:, Date:, Message-ID: and often a long DKIM-Signature: block (see DKIM-Signature).

Return-Path: <bounce-7731@mail.example.net>
Received: from mail.example.net (mail.example.net [203.0.113.40])
        by mx.example.org with ESMTPS
        for <reader@example.org>; Mon, 26 Oct 2026 07:41:12 +0000
Authentication-Results: mx.example.org; spf=pass smtp.mailfrom=mail.example.net

Saving the message as a file

To keep a copy, or to hand it to someone who needs the untouched original, select the message and choose File → Save As → File (Ctrl+S). Thunderbird saves it as an .eml file, which is plain text and opens in any text editor. Opening it in Thunderbird again shows the same message, including its full source.

Common snags

• Ctrl+U does nothing. Click once in the message list to select a message, then try again. If the focus is in the search box or a compose window, the shortcut won't reach the message.
• The source window shows a single message from a whole thread. That's expected: it shows the message you selected. In a collapsed thread, expand it and pick the one you want.
• Forwarding a message to someone for analysis. An ordinary inline forward doesn't carry the original headers. Use Message → Forward As → Attachment, or send them the saved .eml file.
• The source is mostly unreadable gibberish. The body is often encoded (base64 or quoted-printable). The headers above it are still readable, and they're all the analyser needs.
• An add-on changed the layout. Some extensions replace the message header pane. The menu bar route (View → Message Source) is the one least likely to be affected.

Next

Paste the source into the analyser, then:

• Received headers shows how to follow the hops.
• Authentication-Results explains the SPF, DKIM and DMARC verdicts your provider recorded.
• How to spot phishing from headers lists the checks that matter for a suspicious message.