Where did this mailreally come from?
Paste the headers of a mail you are not sure about. See every server it passed, what your provider concluded about its sender, and the tricks worth a second look. It is read in your browser: nothing is sent to us or stored.
Where to find the headers
- Gmail
- Open the mail, then the three dots next to Reply, then Show original, then copy the top part
- Outlook on the web and new Outlook
- Open the mail, then the three dots, then View, then View message details
- Classic Outlook for Windows
- Double-click the mail to open it, then File, then Properties, then copy the box called Internet headers
- Apple Mail on a Mac
- Select the mail, then View, then Message, then Raw Source
- Thunderbird
- Select the mail, then View, then Message Source (Ctrl+U)
The headers are the block at the top, down to the first empty line. Pasting the whole mail works too; the reader stops at the empty line. The Gmail and Outlook apps on phones, and Mail on the iPhone, do not show headers: open the mail in webmail on a computer instead.
Is pasting this safe?
Copying and pasting headers is safe. They are plain text: nothing in them can run, and here nothing leaves your browser. The danger of a phishing mail lies elsewhere: clicking its links, opening its attachments, and above all trusting what it says. Opening the mail itself is a lot safer than it used to be: mail apps no longer run scripts, and most block or hide remote images. Keep your mail app updated and it is safe enough. The less you do with a mail you doubt, the better.
Want to practise on mails with the answer behind them? Spot the Phish has a new one every day.
Asked often
Where do I find a mail's headers?
Gmail: open the mail, the three dots next to Reply, Show original, then copy the top part. Outlook on the web and new Outlook: the three dots, View, View message details. Classic Outlook for Windows: open the mail in its own window, File, Properties, the box called Internet headers. Apple Mail: View, Message, Raw Source. Thunderbird: View, Message Source. Copy everything from the top down to the first empty line. Phone apps mostly do not show headers; use webmail on a computer.
Is it safe to paste a phishing mail here?
Yes. Headers are plain text, nothing in them can run, and they are read by code in your own browser and never sent to us or anyone else. No link becomes clickable and no image is fetched. The dangerous part of a phishing mail is clicking its links, opening its attachments and trusting what it says, not copying its headers.
DMARC passed. Does that mean the mail is real?
It means the mail really comes from the domain in the From address. It does not say that domain is who it pretends to be. A scammer who registers tulpbank-veilig.nl can pass SPF, DKIM and DMARC for it perfectly. Look at which domain passed, not only that something did.
Why does the route start at the bottom of the headers?
Every server a mail passes through adds its own Received line on top. Read top to bottom, the headers go from your inbox back to the sender; the reader turns them around so hop 1 is where the mail started. Lines near the top were written by your own provider and can be trusted most; lines further down were written by servers you know less about, and the very first ones by the sender, who can write anything.
Send a brief. A person reads it.
Tell us what you are running today and what you want it to do instead. You get a personal reply with a price that fits, and if it does not, we work out a plan together. The person who writes to you is the same one who would do the work.
Mon–Fri 08:30–23:00 · Sat–Sun 11:00–00:00 CETReply the same day, 48 hours at most. S/MIME-signed.