How to read message headers in outlook

Email routes in a similar way to your browser’s request for information from a web server. The difference is that you send email without any kind of confirmation that a connection was made to the recipient’s email server. With web browsers, a connection is made, and the web server returns an acknowledgement that the request was successful. With email, your email client sends the message off to an email server with no way of knowing if the message reached its recipient. It could get lost in the void, and you would have no way of knowing. This is why email is an unreliable way of communication even though its an integral part of communication in today’s online life

As you know from previous lessons, you can’t use Outlook until you’ve configured it. You must configure an incoming email server and an outgoing email server that uses the Simple Mail Transport Protocol (SMTP). This protocol has been used for decades to send email. SMTP runs on email servers and accepts messages from senders including your Outlook program.

When you click the “Send” button in Outlook, the software packages your message and sends it to the SMTP server configured. The email server performs a lookup to find out where the email must be sent. Just like web traffic that must be routed using routers that direct traffic using the most efficient path, email messages are also sent using the same routing methods. The only difference is email messages bounce from email server to email server until they reach the designated recipient inbox.

A recipient’s email inbox sits on their own configured incoming server. This server could be a web host’s designated email server. It could also be a corporate email server. Some cloud hosts offer an email server with hosting service. Other recipients lease mail servers from vendors. Regardless of the service, an email server runs simple software that understands that an incoming message should be stored until a recipient logs into their email client and downloads messages. Microsoft Outlook works well with Microsoft’s own email software Exchange. Corporations that use Microsoft as its operating system and network environment often use Exchange as their internal email server.

As an email bounces from email server to email server as it’s routed across the Internet, but each bounce is recorded in the email headers. This helps administrators track them and identify the sender of an email. It can also help individuals identify the sender, but it’s also useful to identify a phishing email.

Many email servers use headers to determine if the sender is from the organization they claim to be from. “Spoofing” email is when a sender identifies an email address from an organization manually. Although the sender can be changed to any manual setting, the recipient’s email service can check headers and identify if the sender email address is forged. If it’s forged, the email is sent to the recipient’s spam inbox. In a corporate environment, the email is filtered and never sent to the recipient’s inbox. This email filtering technique is part of many organization’s cyber security infrastructure.

Viewing Headers in Outlook

Depending on your Outlook configuration, you might need to download email headers for messages that you download to your inbox. Outlook has a button where you can manually download headers from an email server.

(Download headers button to retrieve them from an email server)

The button to download email headers is located in the “Send/Receive” tab. Select the email from your inbox and click the button and Outlook downloads them, although you cannot see them in the current window.

Double click the email message that you want to view. By double clicking a message, it opens in a new window. Now, click the “File” tab. In this tab, you’ll see a button named “Properties.” Click this button and another window opens.

(Window that displays an email’s headers)

The properties of a message have several benefits. This window gives you a list of settings configured by the sender. Notice that the importance of this message is set to normal. You can also identify if a user places delivery and read receipts on a message. When a delivery message is placed on a message, you get notification when the email is sent to the user’s inbox. Since SMTP does not have a way to verify that an email was successfully delivered, this option provides a way for you to verify that it was delivered.

Being delivered does not mean an email was viewed by the recipient, so a read receipt tells you if the email was opened. A message is sent to your inbox for both read and delivery receipts. Note that a recipient can block these receipts from being sent, so they are not a guaranteed way to identify if an email was delivered and read.

The Internet headers are shown at the bottom of the message. The headers in this text box can be long, but you can use Ctrl+A and then Ctrl+C to copy them. You can then paste them into another document to view them. You’ll notice several properties in the email headers that identify the sender, but the routing information can be difficult to dissect. Fortunately, there is a way to plug in headers and see formatted output with information that can be analyzed without reading header content.

Google provides you with a tool that parses header content and gives you the information that you need to identify the sender of an email. The tool can be found at:

Email headers should be read from the bottom to the top. Think of headers as a “first in, last out” configuration. The first email server added to the list is at the bottom of the list, and each new one is added on top of the previous one. The first email server to send the email along its route is place in the headers first, and then each new route is added to the top. This means that the first email server to receive a message is at the bottom of the headers. This can be difficult for readers to understand, so a tool such as Google’s parses the information and makes it easier to understand.

With a read on email headers, you can better understand the path an email had to take to reach its destination to your inbox. It’s these headers that help you identify phishing or a sender that spoofs the sender value to trick you into thinking it’s from a different one. Whenever you receive an email message in Outlook that seems questionable, always look at the headers.

@agiledoc
Oct 11, 2019, 11:23 am EST | 2 min read

Phishing and other email scams are on the rise. One of the best ways to identify scam emails is to examine the email header for detailed information about the sender. Here’s how to do that in Outlook.

Outlook itself provides a basic view of email headers. If that’s not enough, there’s a free add-in that breaks down the headers to give you a more human-friendly view. We’ll cover that as well.

Outlook’s Basic Header View

To get a basic view of the headers for an email, open the email in Outlook and click File > Properties.

In the Properties window that opens, the header is displayed in the “Internet Headers” text box at the bottom.

This text box isn’t very large, so we suggest you select all of the text and copy it into your text editor of choice to make it more visible.

However, the header information is one large block of text, which isn’t that easy to read, especially if you don’t read headers very often. To get a more useful view, there’s a free add-in you can use.

Using the Message Header Analyzer Add-in

If you’ve never installed an add-in to Outlook, we’ve written about the process before. The install process is a pretty simple one plus the add-ins are validated by Microsoft, so they’re safe to use.

And if you install the add-in to the desktop client, as we’re going to show you, the add-in will also automatically be added into the Outlook web app. This enables you to use it when you’re logged into Outlook in a browser, too.

To get started, open Outlook and click on Home > Get Add-Ins.

In the search box in the top right, start typing “message header” and select the “Message Header Analyzer” add-in.

Click the Add button to install the add-in.

Once the add-in is installed, the Add button will change to say “Added.” Click the “X” in the top right to close the window.

When you have an email selected in Outlook, a “View Headers” button will now be visible in the menu bar.

Click this button to see the email headers for the selected email. The add-in has the following tabs:

• Summary: Information (this is the default tab when you open the add-in).
• Received: Information about where the message was received from, and when.
• Antispam: Information from Microsoft’s Exchange Online Protection anti-spam scan of the email.
• Other: All of the other header elements broken down into individual blocks.

Best of all, where there are suitable web pages that relate to an element, the Message Header Analyzer includes a link to that page. This includes links to the exact section in the email specification—such as Authentication-Results—and Microsoft’s information on the anti-spam elements they add to emails that go through Exchange.

Phishing and other email scams are on the rise. One of the best ways to identify scam emails is to examine the email header for detailed information about the sender. Here’s how to do that in Outlook.

Outlook itself provides a basic view of email headers. If that’s not enough, there’s a free add-in that breaks down the headers to give you a more human-friendly view. We’ll cover that as well.

Outlook’s Basic Header View

To get a basic view of the headers for an email, open the email in Outlook and click File > Properties.

In the Properties window that opens, the header is displayed in the “Internet Headers” text box at the bottom.

This text box isn’t very large, so we suggest you select all of the text and copy it into your text editor of choice to make it more visible.

However, the header information is one large block of text, which isn’t that easy to read, especially if you don’t read headers very often. To get a more useful view, there’s a free add-in you can use.

Using the Message Header Analyzer Add-in

If you’ve never installed an add-in to Outlook, we’ve written about the process before. The install process is a pretty simple one plus the add-ins are validated by Microsoft, so they’re safe to use.

And if you install the add-in to the desktop client, as we’re going to show you, the add-in will also automatically be added into the Outlook web app. This enables you to use it when you’re logged into Outlook in a browser, too.

To get started, open Outlook and click on Home > Get Add-Ins.

In the search box in the top right, start typing “message header” and select the “Message Header Analyzer” add-in.

Click the Add button to install the add-in.

Once the add-in is installed, the Add button will change to say “Added.” Click the “X” in the top right to close the window.

When you have an email selected in Outlook, a “View Headers” button will now be visible in the menu bar.

Click this button to see the email headers for the selected email. The add-in has the following tabs:

• Summary: Information (this is the default tab when you open the add-in).
• Received: Information about where the message was received from, and when.
• Antispam: Information from Microsoft’s Exchange Online Protection anti-spam scan of the email.
• Other: All of the other header elements broken down into individual blocks.

Best of all, where there are suitable web pages that relate to an element, the Message Header Analyzer includes a link to that page. This includes links to the exact section in the email specification—such as Authentication-Results—and Microsoft’s information on the anti-spam elements they add to emails that go through Exchange.

Reading the headers of an email message can reveal very useful information for Exchange Server administrators who are diagnosing problems.

Email message header information includes details such as the route that the email took (ie which email servers were involved in the transmission of the message), who sent it, who it was addressed to, and whether the email message was scanned for spam or viruses.

This is useful for both internal and external email messages. As just one real world example, I often need to use email message header information to diagnose message delivery delays.

How to Access Email Message Header Information in Outlook

Each version of Microsoft Outlook lets you access the email message headers, but they do it in slightly different ways.

To read the email message headers in Outlook 2013 click on the arrow next to Tags in the ribbon menu.

To read the email message headers in Outlook 2010 click on the arrow next to Tags in the ribbon menu.

The message options will appear with the email message header information towards the bottom.

Reading Email Message Headers in Notepad

First let’s take a look at how difficult it actually can be to read the raw message header information that you get out of a message in Outlook. If you copy the message header information into Notepad will look like a complete mess.

Even though it is is quite messy and difficult to read you can still see useful information in the message headers. First there is the basic information about the email message itself.

Then there are the email servers that the message passed through on it’s way to the destination. To follow these in order start at the bottom and read upwards.

These lines are generally in the following format:

Received: from servername (IP address) by servername (IP address) with MTA-name; timestamp

When a message passes over several hops this can get a bit confusing to read, especially when the timestamps are all from different time zones. Fortunately there are some useful tools you can use to present the email message header to you in a much easier format to read.

Reading Email Message Headers Using Header Analyzer Tools

Here are three online tools you can use analyze email message headers. For demonstration purposes I’m using the message headers from a spam email message that I recently received in a mailbox in my test lab.

Microsoft Remote Connectivity Analyzer

The Microsoft Remote Connectivity Analyzer includes a Message Analyzer tool. Paste the message headers into the field provided and click Analyze headers to produce the report.

MXToolbox

MXToolbox also has a section of the website for analyzing message headers. Again simply paste the header information into the field provided and you get a nice, graphical report out of it.

Google Apps Toolbox

Finally there is the Google Apps Toolbox which includes a Messageheader analyzer tool that has similar functionality to the others.

Summary

As you can see reading email message headers provides you with a lot of very useful information for diagnosing email problems. You can retrieve email messages easily using email clients such as Outlook, and then use any of the third party message header analyzer tools to produce an easy to read report from that message header data.

Background

A common requirement in Outlook add-ins development is to store custom properties associated with an add-in at different levels. At present, custom properties are stored at the item or mailbox level.

• Item level – For properties that apply to a specific item, use the CustomProperties object. For example, store a customer code associated with the person who sent the email.
• Mailbox level – For properties that apply to all the mail items in the user’s mailbox, use the RoamingSettings object. For example, store a user’s preference to show the temperature in a particular scale.

Both types of properties are not preserved after the item leaves the Exchange server so the email recipients can’t get any properties set on the item. Therefore, developers can’t access those settings or other MIME properties to enable better read scenarios.

While there’s a way for you to set the internet headers through EWS requests, in some scenarios making an EWS request won’t work. For example, in Compose mode on Outlook desktop, the item id isn’t synced on  saveAsync  in cached mode.

See Get and set add-in metadata for an Outlook add-in to learn more about using these options.

Purpose of the internet headers API

Introduced in requirement set 1.8, the internet headers APIs enable developers to:

• Stamp information on an email that persists after it leaves Exchange across all clients.
• Read information on an email that persisted after the email left Exchange across all clients in mail read scenarios.
• Access the entire MIME header of the email.

Set internet headers while composing a message

Try using the item.internetHeaders property to manage the custom internet headers you place on the current message in Compose mode.

Set, get, and remove custom headers example

The following example shows how to set, get, and remove custom headers.

Get internet headers while reading a message

Try calling item.getAllInternetHeadersAsync to get internet headers on the current message in Read mode.

Get sender preferences from current MIME headers example

Building on the example from the previous section, the following code shows how to get the sender’s preferences from the current email’s MIME headers.

This sample works for simple cases. For more complex information retrieval (for example, multi-instance headers or folded values as described in RFC 2822), try using an appropriate MIME-parsing library.

Recommended practices

Currently, internet headers are a finite resource on a user’s mailbox. When the quota is exhausted, you can’t create any more internet headers on that mailbox, which can result in unexpected behavior from clients that rely on this to function.

Apply the following guidelines when you create internet headers in your add-in.

• Create the minimum number of headers required.
• Name headers so that you can reuse and update their values later. As such, avoid naming headers in a variable manner (for example, based on user input, timestamp, etc.).

“ I need to see the entire message that was sent to me, headers, MIME parts, the lot. How can I do that in Outlook?” – Gary G, Taupo NZ.

The short answer is, you can’t, with a possible exception. That’s not the answer you’ll see elsewhere on the Internet but it’s the sad truth.

Outlook can display various parts of a message but not the whole thing, as it arrived from the sender via mail servers.

What to do?

There is one option available in Outlook for Windows, otherwise you have to look elsewhere.

There’s really no way in Outlook or Exchange Server to view the complete message as it arrived (meaning the header and body entire).

For POP3 accounts only, you can add a Registry entry like this:

: Outlook 2016 = 16.0 Outlook 2013 = 15.0 Outlook 2010 = 14.0

DWORD – SaveAllMIMENotJustHeaders value = 1

Then restart Outlook.

Now under Message | File | Properties | Internet headers you’ll see the whole incoming message. This only works for newly arrived messages.

Beyond Outlook

If that doesn’t apply to you, there are alternatives beyond Outlook.

If Outlook is getting mail from a POP3 or IMAP mail host, you might be able to view the source by going to the mail store via a web browser. The ‘webmail’ interface might have a ‘view message source’ option.

If you want to see a complete message, perhaps for debugging or testing, resend it (or CC) to another mail host like Gmail or Outlook.com which has a View Message Source option not available in Outlook. Open the message and look under the menu for various options, one of them is ‘View message source’.

This will open a window or tab with the entire ‘raw’ message: header and all message body parts including text, HTML and attachments.

A detailed and independent look at Windows 10, especially for Microsoft Office.

Fully up-to-date with coverage of the May 2020 major update of Windows 10.

This 1,000 pages, 40 chapter book shows you important features and details for Windows 10 users.

Anatomy of an email message

An email message is made up of various parts (this is a simplification which will do for our purposes.):

• Header. The technical info about the message, sender, recipient and the route it’s taken to reach the sender. Results of any spam or virus checks are added to the header.
• Message Body, which is made up of various parts like
  • Message text perhaps in different formats.
    • In HTML or plain text – either or both can be included.
  • Attachments which are ‘encoded’ for inclusion in emails.

Outlook can show the header – no problem there. We’ll show you how in a moment.

The message text can be sent as plain text, HTML format or sometimes both. See below where there’s a ‘text/plain’ part of the message then a ‘text/html’ version. Outlook will normally use the HTML version of the message and discard the plain text version. You can see the HTML source in Outlook but not all the parts that may have been in the original message.

Attachments – Outlook should convert the encoded part of the email back into files. But there’s no way to see the original encoded version of the attachment. If you could, the ‘raw’ attachment would look like this:

Viewing Message Parts in Outlook

The message header can be viewed at Message | File | Properties | Internet headers

Scroll down to see the entire message header.

There’s a lot to see in a small window, especially when the text wraps around lines. You can select all the header text and copy it to a Notepad or Word document for easier viewing.

There’s also a message header tool to make sense of it.

Part of the message source can be viewed by right-clicking in the message and choosing ‘View Source’. This usually reveals the HTML code for the message, like this:

Despite the name, that’s NOT the entire message source. What you can’t see in Outlook is any other parts of the message body (like a plain text version or encoded attachments).

That’s what Gary meant by the entire ‘raw’ incoming message.

Most of us would never need to bother with such level of detail but if you’re working with the details of email, not being able to access true message source in Outlook is frustrating.

In all Microsoft 365 organizations, Exchange Online Protection (EOP) scans all incoming messages for spam, malware, and other threats. The results of these scans are added to the following header fields in messages:

X-Forefront-Antispam-Report: Contains information about the message and about how it was processed.

X-Microsoft-Antispam: Contains additional information about bulk mail and phishing.

Authentication-results: Contains information about SPF, DKIM, and DMARC (email authentication) results.

This article describes what’s available in these header fields.

For information about how to view an email message header in various email clients, see View internet message headers in Outlook.

You can copy and paste the contents of a message header into the Message Header Analyzer tool. This tool helps parse headers and put them into a more readable format.

X-Forefront-Antispam-Report message header fields

After you have the message header information, find the X-Forefront-Antispam-Report header. There will be multiple field and value pairs in this header separated by semicolons (;). For example:

The individual fields and values are described in the following table.

The X-Forefront-Antispam-Report header contains many different fields and values. Fields that aren’t described in the table are used exclusively by the Microsoft anti-spam team for diagnostic purposes.

X-Microsoft-Antispam message header fields

The following table describes useful fields in the X-Microsoft-Antispam message header. Other fields in this header are used exclusively by the Microsoft anti-spam team for diagnostic purposes.

Authentication-results message header

The results of email authentication checks for SPF, DKIM, and DMARC are recorded (stamped) in the Authentication-results message header in inbound messages.

The following list describes the text that’s added to the Authentication-Results header for each type of email authentication check:

SPF uses the following syntax:

DKIM uses the following syntax:

DMARC uses the following syntax:

Authentication-results message header fields

The following table describes the fields and possible values for each email authentication check.

Recently I was configuring a new email account and needed to check the message headers of an email in Microsoft Outlook 2007. As I discovered it isn’t all that intuitive how to view email message headers in this version of Outlook. This post looks at how to do this.

There are two ways to view the email message headers in Outlook 2007. The first is from the message list as shown in the first screenshot below. Right-click the message in the list and then select the “Message Options” option at the bottom of the popup menu. This is highlighted in the screenshot below and I’ve added a nice big red arrow to point it out as well.

The second way to view the email headers is when you are actually reading the email message in a separate window. The “ribbon” interface has “Message” and “Add-Ins” tabs. Make sure the “Message” tab is selected as shown in the screenshot below. Then click the little box with the arrow on it in the “Options” section. This is highlighted with the red arrow in the screenshot below.

After you have selected “Message Options” from the right-click menu or clicking the little box in the ribbon interface as shown above, you will get a dialogue box like the one below containing message options. This includes the “Internet Headers” section which is highlighted with a red box in the screenshot below.

Unfortunately it’s not possible to resize this window so you are stuck with the small scrollable area to view the email headers, but at least it’s possible, if not in a particularly intuitive place.

Table of Content

• Overview
• Manually Inspecting Message Header
• Automated Method Using Microsoft Remote Connectivity Analyaer Tool
• Summary

Overview

The use of TLS (Transport Layer Security) encryption in emails allow sensitive information to be sent securely through the open and inherently unsecure Internet. Financial institutions, healthcare providers, law firms, or regulated industries are example entities that need or is required to use encryption. They would have information to send or receive via email that needs to be protected from unauthorized disclosure (e.g., eavesdropping). The use of TLS encryption provides the mechanism to accomplish this. But how can one confirm TLS encryption was used in the delivery of an email message? This is were email message headers can help. Every email that is sent has a log of how it was delivered, along with a variety of other information (such as date and time sent, sender information, and recipient information).

For our purpose, the header we are interested in is the Received header. When you send an email, it is often relayed from one email server to another until is reaches the recipient. Email servers that relay your message, also called hops, record details about its handling of your email in the message header. It includes information about its hostname, IP address, and whether encryption was employed for the delivery of your email.

There are two ways to check to see if an email was encrypted with TLS throughout its journey to the recipient’s email box. The manual method involves inspection of the message header with your own eye. The other method is automated analysis using a tool. While using a tool to perform the analysis makes sense, it is important to have a general understanding on how to inspect message headers with your own eyes to identify the use of TLS.

Manually Inspecting Message Header

Looking at the example message header below, we see that a few servers were involved in the delivery of this particular email. Looking as each of the Received header, we can identify that TLS encryption (highlighted in yellow) was used by each server to secure the message throughout the journey of this email from the sender’s email server to the recipient’s. The Received headers all have a timestamp and it is read from the bottom to the top as this is the sequence of servers the email traveled through. It should be noted that other than the Received headers, all other headers can be forged. Thus, take the information you see with a grain of salt – particularly if your investigating whether an email is authentic.

Automated Method Using Microsoft Remote Connectivity Analyzer Tool

Located at the Microsoft Remote Connectivity Analyzer is easy to use. Simply paste your message headers into the textbox provided and click the Analyze headers button. In the example screenshot below, information about the use of TLS encryption neatly found on the last column, highlighted in yellow. This shows TLS encryption was employed throughout the email’s journey as it was relayed from one server to the next. Unlike the raw message header, the Microsoft Remote Connectivity Analyzer neatly organize each Received header in its report from top to bottom.

Reminder!

It is important to know that many elements of an email header can be forged (also known as spoofed). Only the Received line and lines beginning with X are to be trusted with high confidence.

Summary

The use of TLS, and Enforced TLS in a lot of cases now, is becoming more and more common. Cyber criminals are continually trying to intercept and read other people’s emails with malicious intent. Sometimes it is for some financial gain, other times it may be to steal someone’s identity. Regardless, if you work for a company that sends or received sensitive information by email (such as corporate research information or trade secrets, patient health information (HIPAA), or customer’s personally identifiable information (PII), it is highly recommended that you employ TLS. Many email providers are moving towards supporting TLS. If yours does not, you can either move to another email service provider that does, or look into supplementing your existing email solution with a third-party secure email providers.