InfoSec Blog - Exporting Email Headers

Code

February 26, 2020

If you have ever contacted the CCS Help Centre regarding an email issue such as SPAM or phishing, you may have been asked to provide the full header information for the email messages in question. This blog post is meant to help you understand what email headers are, what they are used for, and how to view them.

 

What is an Email Header?

Email headers are markup language code that contains detailed information about the sender, recipient, and the email's path to reach your inbox.  It may also include important information such as the email client used, tracking information, and security mechanisms utilized to ensure the message doesn't contain malware.  The header is part of every email message, and always comes before the body of the message . Here is a sample:

Image Source: SANS Institute

 

As you can see, the full email header includes much more information than just the sender and recipient. When investigating an email issue, this additional data is necessary to fully understand the contents and origin of the message. A common use for the email header is to determine if a message is legitimate or not. While it's possible for email to be spoofed to look like it came from someone else, the email header will always reveal the true sender when there is any doubt.

 

How to View the Full Email Header on Various Email Clients

If you are ever asked to provide the full email header from a message, simply forwarding the message will not provide the detail necessary. Instead use the following steps for the appropriate email client to view the full header:

Office365 Online
(Outlook Web Access)
  • Double-click the message.
  • Within the message where you see the Like, Reply, and Reply-All, click the 3-Dot button for additional actions.

Details

  • Choose 'View Message Details' from the drop-down list to view the full header.
Outlook (Windows)
  • Double-click the message.
  • From the File menu, choose Properties.
  • The full header information will be displayed in the 'Internet headers' section. 
  • Saving a message in Outlook Message Format will also preserve the header information 
Outlook (macOS)
  • Command click (or right-click) the message and choose 'View Source'.
  • The headers will be opened in TextEdit.
  • Saving a message in Outlook Message Format will also preserve the header information ​
Gmail
  • Open the message.
  • Click the 3-Dot icon next to the Reply button in the top right of the message.

Details

  • Choose 'Show Original' from the drop-down menu.

​​​

As always, if you have additional questions or concerns contact the Information Security team directly at infosec@uoguelph.ca.

 

Written By: Stephen Willem (Chief Information Security Officer)