Ò»±¾µÀÎÞÂë

Display Email Headers

In order to investigate reports of email phishing or malware/virus distribution, the Information Security Office (ISO) needs to obtain the full message - body, full headers and any attachments. Forwarding the message typically does not include the full headers.

An email header is a block of information about the message that includes the sender, the recipient, the date, sending and receiving time stamps and the servers that handled the transfer of the message. These headers are usually hidden from view. 

To help our community stay safe and make reporting easier, Computing Services and the ISO have made the PhishAlarm Report Phish add-in available to those using Google and Exchange for email. The PhishAlarm Report Phish add-in allows you to easily report potential phishing messages, including header information, to the ISO with the click of a button. Follow the link in the sidebar to learn more about PhishAlarm and to enable this optional feature.

If not using PhishAlarm, users will need to view and forward the email header to the ISO for further investigation. Follow the Display Email Header steps listed below for the most commonly used email clients.

In Outlook for Windows

1. In Outlook, open the offending message by double clicking on it. This will open the message in a new window
2. In the new window, select Info under the File menu, then look at Properties.
3. Copy and paste the contents of the Internet Headers field into your message to iso-ir@andrew.cmu.edu

In Outlook 2016 for Mac

1. Select the message in Outlook (Do not double click to open the message).
2. Hold the Control key and click on the message. A new menu should appear.
3. Select View Source (at the bottom of the menu). This will open a new window.
4. Copy and paste the contents of the Internet Headers field into your message to iso-ir@andrew.cmu.edu

Forward Message as Attachment in Outlook

1. Select the email you want to forward, then go to the Home tab
2. In the Respond group, select More Respond Actions. In Outlook 2010, select More
3. Select Forward as Attachment
4. In the To text box, enter iso-ir@andrew.cmu.edu . In the subject write "Potential Phish"

In OWA

1. Open the offending message
2. Under Actions on the far right, select "View Original Message"
3. In the new window, select "Message Details" (button looks like a letter and envelope)
4. Copy and paste the content of the text box under "Internet Mail Headers" into your message to iso-ir@andrew.cmu.edu

In Gmail

1. Open the offending message
2. On the right hand side of the message body, use the pull down tab (3 dot ellipsis) and select "Show original"
3. Copy and paste the displayed information into your message to iso-ir@andrew.cmu.edu

Forward Message as Attachment in Gmail

1. Select the email that you want to report
2. Click the vertical ellipsis More and select Forward as attachment
3. In the To field, add iso-ir@andrew.cmu.edu with a subject message of "Potential Phish"

In Apple OS X Mail

1. In Mail, open the offending message in a new window by double clicking on the message
2. Select View --> Message --> Raw Source
3. Copy the headers by right clicking, selecting all then choosing copy
4. Paste the displayed information into your message to iso-ir@andrew.cmu.edu

In Entourage

1. If the email message is not open in a separate window, double click it to do so
2. Choose View menu and select Internet Headers
3. Click inside the new box that appears in your message and choose Edit/Select All
4. Click inside the box again and choose Edit/Copy

In Thunderbird

1. In Thunderbird, open the offending message
2. Select View --> Headers --> All
3. Copy and paste the headers into your message to iso-ir@andrew.cmu.edu

In Pine

1. Make sure that the enable-full-header-cmd option is turned on (this option lets you display the Internet Headers for a message)
   • From the main menu, type S for Setup and C for Config
   • Find the Advanced Command Preferences, and check the enable-full-header-cmd item
   • Type E to exit and Y to save your changes
2. Open the offending message
3. Type H to toggle on Display full headers
4. Type F to forward the message to iso-ir@andrew.cmu.edu.
5. Once the message is sent, type H again to turn off Display full headers.

Note: In some email clients, forwarding the message as an attachment will include the full headers which may be easier than looking for them to cut and paste.

Revision History