Every email comes with a large block of hidden text called “headers.” These headers describe every step an email took on its journey from sender to receiver, and are helpful in determining the true source of an email. Finding these headers is not often obvious. In this article, we’ll show you how to obtain these headers either for your own investigation or to send to Coalition Incident Response (CIR).

Google Suite and Gmail

1. Navigate to the email message you would like to obtain header information for.
2. Click the icon with the 3 dots on the top-right of the message and select “Show Original”

3. The resulting screen will have all the headers and the original email in one place. You can EITHER download the entire email, with headers, or you can copy and paste the data.

Microsoft Office365, Outlook.com, Live.com,

Hotmail.com

1. Navigate to the email message you would like to obtain header information for.
2. Select the icon with 3 dots at the top right of the email message

3. In the resulting menu, select “View Message Details”

4. This will open a popup window with all your email headers. You can copy the headers and paste them wherever you need to for investigation (e.g. email or a document).

Microsoft Outlook

1. Open Microsoft Outlook. Navigate to the email message you would like to obtain header information for. Double click this message to open it in a new window.
2. Within the message window, navigate to Message > Tags and select the arrow in the bottom right hand corner to expand the Tags section.

3. In the properties window that opens, navigate to the Internet headers section at the bottom of the section. Highlight all the information (Ctrl + A) and then copy (Ctrl + C).

4. You can now paste the Header information into an email to send to CIR or into a document to inspect manually.

Mac Mail (mail.app)

1. Open Mac Mail. Navigate to the email message you would like to obtain header information for. Double click this message to open it in a new window.
2. Select View->Message->All Headers

3. Your email will now display all the email headers. You can copy and paste the email at this point.

4. Note: Repeat the process to hide headers

Mozilla Thunderbird

1. Open Thunderbird. Navigate to the email message you would like to obtain header information for. Double click this message to open it in a new window.
2. Click the “More” Button and select “View Source”

3. The resulting window will display the full email with headers. You can save this output or copy and paste it.