How can I see the full headers of an email message to find out where it really originated?

Last revision May 12, 2005

As email messages traverse the Internet, every computer that handles the message adds a Received: header line that identifies itself and the time at which it received the message. The originating computer may also add other header lines containing useful information about the message. Normally, email programs do not show all these "extra headers", as they clutter up the display. Instead, they show just the basic headers, such as From:, To: and Subject:.

If you are having trouble with email messages that get returned to you or complaints about email viruses that appear to be coming from you, then it is essential to see the full headers of the message in order to understand what is happening. In particular, the earliest dated Received: header line will show the true identity of the computer that originated the message, even if the From: header has been falsified.

Whenever you ask for help with email problems, always include the full headers when you forward or print an email message. This note tells you how to display full headers in popular email programs used at Stanford Earth Sciences.

You can view full headers in Eudora by first opening a message in its own window (double-click in the mailbox index window), and then clicking on the button that appears in the Icon bar just above the message text. This setting only applies to the message you are currently viewing.

You can view full headers in Microsoft Outlook by first opening a message in its own window (double-click in the mailbox index window), and then select Options from the View menu. An Internet Headers window should open, showing the full headers. This setting only applies to the message you are currently viewing.

You can view full headers in MacOS X Mail by first opening a message in its own window, and then selecting Show All Headers in the View menu. This setting only applies to the message you are currently viewing.

You can view full headers in pine by pressing the H (Headers) key. This flips into "full headers mode" and presents the current message and all future messages (in the same session) with full headers, until you press the key again to flip back to normal mode.

If you read email using pangea's Webmail system, you can view full headers by first selecting a message, and then clicking on the View Full Header option that is shown right below the basic headers. The current message will be re-displayed with full headers.

If you read email using Stanford's central email server Webmail system (for @stanford.edu addresses), you can view full headers by first selecting a message, and then clicking on the Message Source button just above the display of the message. The current message will be displayed with full headers in a separate window.

Information on how to view full headers for other, lesser used, email programs can be found in the SpamCop FAQ.

Comments?