Extracting headers from common email clients

To accurately determine the origin of spam you need to include the email headers of the offending message in addition to the message when reporting spam

Click on the link for details for the following email clients

Gmail

  1. Open the individual message.
  2. At the top-right corner of the message window, click the down arrow next to Reply, or select More options.
  3. Click Show original. A new browser window will open showing full header information.
  4. Go to the Edit menu and choose Select All
  5. Go to the Edit menu again and choose Copy
  6. You can now paste the copied text into an email.

Outlook Express 4,5,6

Start by opening the message in its own window (or when viewing the message in the preview pane). Then:

with the keyboard:

  1. CTRL-F3 (Message Source Window)
  2. CTRL-A (select all)
  3. CTRL-C (copy)
  4. ALT-F4 (close)

With the mouse:

  1. Click the “File” menu
  2. Click “Properties”
  3. Click the “Details” tab
  4. Click “Message Source”
  5. Highlight, copy and paste everything from this window (Ctrl-A, Ctrl-C)

With viruses, worms and trojans being spread via email, many users now work with the preview screen in Outlook Express turned off. Viewing the contents of email in the preview screen is no different than opening the message. If the email has malicious content, it may execute in the preview screen.

The following is instructions to obtain the full message source if you have the preview panel turned off:

Using the keyboard:

  1. Highlight the message in the folder
  2. Press alt + enter – this will open a message information window
  3. Press Ctrl + Tab – this changes to the “Details” tab
  4. Press Alt + m – the opens the message source
  5. Press Ctrl + a – to select all the text
  6. Press Ctrl + c – to copy the selected text to the clipboard
  7. Press Alt + F4 – to close the message source window
  8. Press the Esc key – to close the information window

Outlook 97

Microsoft Outlook 97 may require an update called the Internet Mail Enhancement Patch in order to display the email headers AT ALL.


Outlook 98 and 2000

  1. Open the message in a separate window (double click)
  2. Under the View menu select Options
  3. Copy the text in the Internet Headers window (unfortunately it doesn’t include the message itself).
  4. Paste
  5. Close the options window

Microsoft Exchange

  1. To get the complete headers and message source using Microsoft Exchange Click the “File” menu
  2. Click “Properties”
  3. Click the “Details” tab
  4. Click “Message Source”
  5. Highlight, copy and paste everything from the “Message Source” window (Ctrl-A, Ctrl-C)

Netscape

Preferred method: Click on the “View” menu, then “Page Source,” (ctrl-U in windows, meta-U in UNIX,?-U on the Mac) then copy the contents of the window (Ctrl-A, Ctrl-C windows).

Old versions: Click on the “View” menu, then “Headers,” then “All.” Note: This method will not work correctly with HTML.


Thunderbird

  1. Open the message in a seperate window (double click)
  2. Under the View menu select “headers” … “all”
  3. Click the “Forward” button to forward the email to a third party
  4. Either view the message as is (with full headers) to the required address
  5. Or: select the headers and copy-paste into a new message
  6. Close the message windows

Eudora

Note: Using the cut and paste to the web form method is the only option available to Eudora users. To display the full message source for cut and paste:

Eudora for the PC – there are 2 slightly different methods depending on whether the mail contains HTML or not.

In any case, to prepare for HTML email, you should turn off the use of Microsoft’s HTML viewer. To do so, click Tools, then Options, then Viewing Mail. Uncheck the box labeled “Use Microsoft’s viewer.”

How to know if it’s HTML mail: once you have opened the email, look near the bottom of the headers (see below for revealing headers) for a line like the following: Content-Type: text/html … you can frequently spot HTML email because it has font effects, pictures, etc but this is not always true so you have to take a quick look at the headers.

Eudora for the PC – non-HTML mail:

  1. Open the email by double clicking on the subject line. Click the button to reveal the headers.
  2. Place your cursor anywhere in the body of the email and select the entire message (Edit/Select All or Ctrl-A)
  3. Copy the entire email (right click and click copy OR Ctrl/C OR Edit/Copy)
  4. Paste (right click/paste or Ctrl/V).

Eudora for the PC – HTML mail:

  1. Open the email and click the button to reveal the headers.
  2. Highlight the headers only. Copy and paste the headers.
  3. Hit enter twice after the pasted headers to force a blank line after the headers.
  4. Back in Eudora window, place your cursor anywhere in the body of the message and right click and click “view source”. A new window will open.
  5. In the new window, select all (as above) and copy the contents of the new window.
  6. Paste.

Pine

If the feature is enabled, you simply press H to toggle full headers. If the feature is not enabled, you must enable it first: From the main menu, press (S)etup, (C)onfig. Scroll down about 40 lines to the option labeled “enable-full-header-cmd.” Press [ENTER]. Press (E)xit, (Y)es – to save. Then you can return to the message window and use H to display the headers.


Mutt

To get mutt (the mail user agent) to forward the full headers (not display them for viewing), use the command “unset forward decode” in your rc file or directly in the command interface.


Lotus Notes (v4.x and v5.x)

Open the email, click on “Actions” then on “Delivery Information.”

Next, you have to pick out the internet-style mail header information from the window that appears when you select Delivery Information.

Lotus Notes v.4.x

Look for the first line that begins with “Received”. There should be a blank line just above it. Then, scroll down to the next blank line. The stuff in-between the two blank lines are the headers you need.

Lotus Notes v.5.x

Look for the separator line that reads

——– Additional Header ——

Select everything from there down to the next separator line, usually

——– Routing Information ——

The stuff in between the two separator lines are the headers you need.

Lotus Notes v.5.x (easier method)

  1. Open your inbox
  2. Highlight the message that you wish to get header information for.
  3. Choose File -> Export…
  4. Type in a filename, leave the type as “Structured Text” and click Export
  5. From the Dialog Box that comes up, choose “Selected Documents” and click OK
  6. Now you can open that message you saved in WordPad and Cut and Paste it.

Pegasus Mail

In the New Mail or other folder window:

  1. Right click the message, and select Message Properties.
  2. In the right hand column uncheck the box beside Contains HTML data.
  3. Click OK. That should allow you to see the message as a text message only.
  4. Click Ctrl-H to bring up the full headers.

Another way:

  1. Highlight the HTML in the new mail folder
  2. Open a new email message
  3. Drag the HTML onto the new message
  4. In the dialog that appears select “Show All Headers”
  5. Highlight the entire message, then copy to clipboard
  6. Paste

Kmail (KDE Desktop)

In the KDE Mail Client that comes with the KDE desktop for Linux, select Message, View Source. Copy and paste the text from the “Message as Plain Text” window.


Ximian Evolution

Go to the “View” menu, select “Message Display” and click on “Show Full Headers”.


StarOffice

  1. Right click on the container name in the explorer panel (either a top-level mail box or a specific mail folder).
  2. Select the Properties item from the pop-up menu.
  3. In the properties notebook, select the Headers tab.
  4. Click the “All” button on the right.
  5. Press “OK” and you’re done, the complete header is available in the header panel and can be selected/pasted.

Novell Groupwise

  1. Open the message
  2. In the message window select: File > Attachments > View
  3. Select the Mime.822 attachment

Source information obtained from:

Most of the information above was obtained from here: http://www.abika.com/Reports/Samples/emailheaderguide.htm

Contact Details

Tel: 010 500 1200 or 087 550 1200
Fax: +27 (0) 87 606 4066
Email: queries [at] ispa.org.za