← Back to the forensics tool

How to find an email's headers

30-second guides for the five most common UK email apps. Pick yours.

What are "headers"? Every email has hidden technical info that proves where it really came from — like the postmark and routing slip on a physical letter. We use these to detect forgery. The actual message you read is just the icing; the headers are the cake.

Gmail (web)

  1. Open the suspicious email.
  2. Click the three vertical dots ⋮ on the right of the email header (next to the Reply arrow).
  3. Select "Show original".
  4. A new tab opens. Click the "Copy to clipboard" button near the top, or select all the text under "Original Message" and copy.
  5. Paste into the SignalTools form.

Outlook (web / 365)

  1. Open the suspicious email.
  2. Click the three horizontal dots ⋯ at the top right of the message pane.
  3. Select "View" → "View message source".
  4. A dialog opens with the raw email. Select all (Ctrl + A) and copy (Ctrl + C).
  5. Paste into the SignalTools form.

Apple Mail (Mac)

  1. Open the suspicious email.
  2. From the menu bar, choose View → Message → All Headers (or press ⇧⌘H).
  3. Select all visible text including headers (⌘A) and copy (⌘C).
  4. Paste into the SignalTools form.

Yahoo Mail (web)

  1. Open the suspicious email.
  2. Click the three horizontal dots ⋯ at the top right of the message.
  3. Select "View raw message".
  4. A new tab opens. Select all (Ctrl + A) and copy.
  5. Paste into the SignalTools form.

Hotmail / Outlook.com

  1. Open the suspicious email.
  2. Click the three horizontal dots ⋯ next to Reply.
  3. Select "View message source".
  4. A dialog opens with the raw email. Select all and copy.
  5. Paste into the SignalTools form.

Mobile (any platform)

  1. Forward the suspicious email to yourself at a different account you can access on a computer.
  2. Open it on the computer using one of the guides above.
  3. Mobile apps generally don't expose raw headers — Gmail's iOS / Android apps for example don't have "Show original".
  4. Tip: if you only have a phone, save the email and try again later on a desktop browser.

← Back to the forensics tool