How to Find Email Headers

Before you can analyze an email for phishing, you need to get the raw headers. Here's how to find them in every major email client.

✉ Gmail (Web)
1
Open the email you want to investigate. Don't click any links inside it.
2
Click the three-dot menu (⋮) in the top-right corner of the email, next to the reply button.
3
Select "Show original" from the dropdown menu.
4
A new tab opens with the raw email. Click "Copy to clipboard" at the top, then paste into our Email Header Analyzer.
Tip: Gmail's "Show original" page also shows SPF, DKIM, and DMARC results at the top — but our analyzer gives you deeper detail and a risk score.
📧 Outlook (Web / Microsoft 365)
1
Open the suspicious email in Outlook on the web (outlook.office.com or outlook.live.com).
2
Click the three-dot menu (⋯) at the top-right of the email message.
3
Select "View" → "View message source" (or just "View message details" in some versions).
4
A panel opens with the raw headers. Select all (Ctrl+A), copy (Ctrl+C), and paste into the analyzer.
💻 Outlook (Desktop App)
1
Double-click the email to open it in its own window.
2
Go to File → Properties (or right-click the email in the list and select "Message Options").
3
Find the "Internet headers" text box at the bottom of the dialog. Select all, copy, and paste into the analyzer.
📩 Yahoo Mail
1
Open the email in Yahoo Mail on the web.
2
Click the three-dot menu (⋯) next to the reply/forward buttons.
3
Select "View raw message".
4
A new tab opens. Select all, copy, and paste into the analyzer.
🍎 Apple Mail (macOS)
1
Select the email in Apple Mail.
2
Go to View → Message → All Headers in the menu bar (or press ⌘ Shift H).
3
The full headers appear in the message view. Select and copy the header portion, then paste into the analyzer.

Ready to analyze?

Paste your copied headers into the analyzer and get a risk score in seconds.

Open Email Header Checker →
What the analyzer checks

Once you paste the headers, our tool automatically extracts and checks:

Authentication

SPF, DKIM, and DMARC pass/fail status

Sender Mismatches

From vs Reply-To vs Return-Path domains

Routing Hops

Server-by-server path the email traveled

IOCs

Extracted domains, IPs, and email addresses

Related guides