Carnegie Mellon University

Display Email Headers

In order to investigate reports of email phishing or malware/virus distribution, the Information Security Office (ISO) needs to obtain the full message - body, full headers and any attachments. Forwarding the message typically does not include the full headers.

An email header is a block of information about the message that includes the sender, the recipient, the date, sending and receiving time stamps and the servers that handled the transfer of the message. These headers are usually hidden from view. To view and send an email header, follow the steps listed below for the most commonly used email clients.

In Webmail

  1. Go to http://webmail.andrew.cmu.edu, login and open the offending message
  2. Click the View Full Headers link under the headers
  3. Copy and paste the headers into your message to iso-ir@andrew.cmu.edu

In Outlook for Windows

  1. In Outlook, open the offending message by double clicking on it. This will open the message in a new window
  2. In the new window, select Info under the File menu, then look at Properties.
  3. Copy and paste the contents of the Internet Headers field into your message to iso-ir@andrew.cmu.edu

In Outlook 2016 for Mac

  1. Select the message in Outlook (Do not double click to open the message).
  2. Hold the Control key and click on the message. A new menu should appear.
  3. Select View Source (at the bottom of the menu). This will open a new window.
  4. Copy and paste the contents of the Internet Headers field into your message to iso-ir@andrew.cmu.edu

In OWA

  1. Open the offending message
  2. Under Actions on the far right, select "View Original Message"
  3. In the new window, select "Message Details" (button looks like a letter and envelope)
  4. Copy and paste the content of the text box under "Internet Mail Headers" into your message to iso-ir@andrew.cmu.edu

In Gmail

  1. Open the offending message
  2. On the right hand side of the message body, use the pull down tab (triangle) and select "Show original"
  3. Copy and paste the displayed information into your message to iso-ir@andrew.cmu.edu

In Apple OS X Mail

  1. In Mail, open the offending message in a new window by double clicking on the message
  2. Select View --> Message --> Raw Source
  3. Copy the headers by right clicking, selecting all then choosing copy
  4. Paste the displayed information into your message to iso-ir@andrew.cmu.edu

In Entourage

  1. In Entourage, open the offending message
  2. Select View --> Internet Headers
  3. Copy the header section (at the top of the message) and paste it into your message to iso-ir@andrew.cmu.edu

In Thunderbird

  1. In Thunderbird, open the offending message
  2. Select View --> Headers --> All
  3. Copy and paste the headers into your message to iso-ir@andrew.cmu.edu

In Pine

  1. Make sure that the enable-full-header-cmd option is turned on (this option lets you display the Internet Headers for a message)
    • From the main menu, type S for Setup and C for Config
    • Find the Advanced Command Preferences, and check the enable-full-header-cmd item
    • Type E to exit and Y to save your changes
  2. Open the offending message
  3. Type H to toggle on Display full headers
  4. Type F to forward the message to iso-ir@andrew.cmu.edu.
  5. Once the message is sent, type H again to turn off Display full headers.

Note: In some email clients, forwarding the message as an attachment will include the full headers which may be easier than looking for them to cut and paste.