Email headers have technical details about all the emails that you receive. The body of the email contains information on the content while the header will provide all the information about the complete path of the email, from the sender’s mail server to your email. Analyzing email headers Outlook allows you to detect phishing, check the path of the email delivery, authenticate the sender and even scrutinize suspicious emails.
No matter if you are an IT manager, security specialist, or an ordinary user of Outlook, knowing how to analyze email headers Outlook will help you to make the right decision regarding received emails.
In this tutorial, you will learn how to analyze email headers Outlook.
What Are Email Headers?
The header of an email is the meta data that is added to each email message. This data includes information like:
- Information about the sender
- Information about the recipient
- Time stamp
- Email servers that processed the email
- Authentication information
- Message identifier
- Return path
- IP addresses
Unlike the body of an email, the header is invisible because it includes technical data.
Why Should You Analyze Email Headers?
The importance of understanding email headers lies in the following points:
- Identification of phishing emails and spoofs
- Identification of the true sender
- Analysis of delayed emails
- Inquiry into spam emails
- Checking SPF, DKIM, and DMARC validation
- Email routing from one mail server to another
These aspects will be very helpful for you if you are handling suspicious or fake emails.
#1: How to Get Message Header in Outlook (Classic Outlook)
In case you are using the traditional desktop version of Outlook, then here are the steps.
Step 1: Open your Email
At first, search for the email you want to analyze.
Click on the email so that it opens in a separate window rather than in the Reading Pane.
Step 2: Click File Menu
Then, click on the File menu in the upper left-hand corner.
Step 3: Tap on Properties
From the given options, you can hit on the Properties tab.
Step 4: Find Internet Headers
- Next, navigate to the bottom of Properties box.
- There will be a box titled Internet Headers.
- It will hold the full header of the email.
This is the simplest way to learn how to analyze email header in Outlook by using a desktop app.
Read more: Check this article on if you want to search for specific email in Outlook
#2: How to Find Message Header in Outlook (New Outlook)
In the new Microsoft Outlook interface, you might see the email header location in a different place. Here are the steps to follow:
Step 1
Open your email.
Step 2
Click on the More actions button (three dots).
Step 3
Select:
View → View Message Details
The full email source will be displayed.
#3: How to Copy Message Header in Outlook
There are times when IT support or security will require you to copy the email header completely.
Below is how you will go about doing so.
Classic Outlook
- Open your email.
- Go to File.
- Then click on Properties.
- Click on the Internet Headers text box.
- Hit Ctrl + A and then Ctrl + C.
Header is now completely copied.
New Outlook
- Go to View Message Details.
- Highlight all the header texts.
- Then hit Ctrl + C.
How to Check Message Header Outlook?
After the header has been copied, the next thing to do is learn the data.
When one is asking about how to look at message header Outlook, he or she means that one should check the most essential headers.
Here are some of them.
- From
- Shows the address of the sender.
- Compare it to the Return-Path in order to prevent spoofing.
- Return-Path
- The field which indicates to where the message is delivered in case of failure.
- If it is significantly different from the sender address, then one should conduct more checks.
- Received
This field is added by each mail server.
Read these fields from the bottom up.
Find:
- Unexpected mail servers
- Unexpected IP addresses
- Delivery problems
- Message-ID
- All the legitimate emails have a unique Message-ID.
- Lack of it can be suspicious.
- Authentication Status
The columns contain:
- SPF
- DKIM
- DMARC
The ideal result is for all to pass.
A failure might mean spoofing or incorrect configuration.
- Date
The sending time must be compared against the received dates.
Significant discrepancies could highlights server side delays.
- Reply-To
It is often observed that attackers change the Reply-To address without altering the From address. As a result, both should be checked.
Common Signs of a Suspicious Email Header
Watch for these warning signs:
- SPF Fail
- DKIM Fail
- DMARC Fail
- Multiple unknown mail servers
- Mismatched sender domains
- Strange Return-Path
- Missing Message-ID
- Unexpected originating IP addresses
These often indicate phishing or spoofed emails.
Tips for Better Email Header Analysis
Consider these tips:
- Always validate authentication records.
- Check whether From and Return-Path headers match.
- Analyze all received headers.
- Ensure that the timestamps make sense.
- Make sure that the sender’s IP is owned by the same organization.
- Research abnormal routing.
Such straightforward techniques will greatly enhance your e-mail safety.
Alternative Approach for E-mail Analysis Offline
In case you need to look through your Outlook PST files without installing Outlook itself, the use of SysTools PST Viewer Software allows you to do so easily by opening your mailboxes and thus enabling you to access emails to check their headers.
Step-1. Firstly, install the software on your Windows PC and run it.
Step-2. Now, click on the Add File option to add the PST file which you want to view.
Step-3. At the time of selecting the PST file, you can also select the Advanced Scan option if the PST file is highly corrupt.
Step-4. Click on the Add File option. In a few moments, the software will show you all the information related to the PST file.
Step-5. It is very easy to open emails, contacts, calendars, notes, etc. Selecting any particular thing will open it for you.
Step-6. Various preview modes like Hex, Properties, Message Header, HTML, RTF, Attachments, etc. are provided by the software, using which you can open and view PST emails as per the requirement.
There is no case of data loss, hacking, or anything related to size limitations in connection with the software. There are several functions incorporated in the software, which helps it be an all-around utility that can open and read PST files even without installing the Outlook email client on your computer. You may upgrade to PST Viewer Pro for more functions.
Frequently Asked Questions
Q. Is it possible to see email headers without using Outlook?
Ans. Yes, because most email providers have an option allowing viewing the full original message or message source.
Q. Why are email headers useful?
Ans. They help identify phishing emails, authenticate senders, solve delivery problems, and track the route an email goes through.
Q. Are email headers editable?
Ans. Some of the headers, like Subject or From, can easily be changed. Nevertheless, received headers that are automatically added by mail servers cannot be spoofed as easily.
Q. Is it safe to disclose email headers?
Ans. For the most part, yes. However, headers may include IP addresses and other routing information, and thus they should not be disclosed to anyone except for trusted IT or security professionals.
Final Words
Acquiring the skills of analyzing email headers in Outlook helps to increase security and resolve issues related to delivery problems. You will be able to recognize phishing messages, determine the authenticity of the sender, and discover routing problems.
