Support

View the header information of an email message

The following article explains how to view the header information of an email message. The header of an email message contains information about the path an email message has taken. It shows the different mail servers it has gone through as well as where it originated from. An example header is below:

Received: from clustermx11.nwk01.hosting.com (204.12.102.46) by

hatchet.hostmysite.com (76.12.55.188) with Microsoft SMTP Server id

8.2.176.0; Fri, 21 May 2010 17:25:51 -0400

Received: from clustermx4.nwk01.hosting.com (clustermx4.nwk01.hosting.com

[204.12.102.39]) by clustermx11.nwk01.hosting.com (HDCMail-slowmx) with ESMTP

id 0DAF19880A for <recipient@domain.com>; Fri, 21 May 2010 17:25:09 -0400

(EDT)

Received: from mail48.safesecureweb.com (mail48.safesecureweb.com

[65.36.214.244]) by clustermx4.nwk01.hosting.com (HDCMail-outmx) with ESMTP

id 0E17F368F15 for <recipient@domain.com>; Fri, 21 May 2010 17:16:27 -0400

(EDT)

Received: by mail48.safesecureweb.com via HTTP; Fri, 21 May 2010 17:16:23

-0400

From: First Name Last Name <sender@domain.com>

To: <recipient@domain.com>

Subject: Test

Date: Fri, 21 May 2010 17:16:23 -0400

Reply-To: sender@domain.com

Message-ID: <120e2fc8$11858475$12ffdda9$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0001_3823DABC.65547FA0"

X-Originating-IP: [209.41.163.23]

Return-Path: sender@domain.com

What does the header information report to me?

Received: from clustermx11.nwk01.hosting.com (204.12.102.46) by

hatchet.hostmysite.com (76.12.55.188) with Microsoft SMTP Server id

8.2.176.0; Fri, 21 May 2010 17:25:51 -0400

This states that the email is coming into hatchet.hostmysite.com from the outbound gateway clustermx11.nwk01.hosting.com.

Received: from clustermx4.nwk01.hosting.com (clustermx4.nwk01.hosting.com

[204.12.102.39]) by clustermx11.nwk01.hosting.com (HDCMail-slowmx) with ESMTP

id 0DAF19880A for <recipient@domain.com>; Fri, 21 May 2010 17:25:09 -0400

(EDT)

This shows that the email then goes to another outbound cluster of servers clustermx4.nwk01.hosting.com of where it was passed off to by cluster clustermx11.nwk01.hosting.com. This portion of the header also shows the recipient of the email recipient@domain.com and date and time the message was received: Fri, 21 May 2010 17:16:27 -0400 (EDT).

Received: by mail48.safesecureweb.com via HTTP; Fri, 21 May 2010 17:16:23

-0400

From: First Name Last Name <sender@domain.com>

To: <recipient@domain.com>

Subject: Test

Date: Fri, 21 May 2010 17:16:23 -0400

Reply-To: sender@domain.com

Message-ID: <120e2fc8$11858475$12ffdda9$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0001_3823DABC.65547FA0"

This portion of the header shows the original message originated from mail48.safesecureweb.com via webmail (HTTP) and the original time the message was sent: Fri, 21 May 2010 17:16:23 -0400. As you can now see, the message took about 10 minutes to arrive since the receiving time was Fri, 21 May 2010 17:16:27 -0400 (EDT) as noted previously. The subject, message ID, recipient and MIME-version are all listed here as well.

X-Originating-IP: [209.41.163.23]

Return-Path: sender@domain.com

The last portion of the message gives the originating IP. In this case, it was sent from 209.41.163.23 which is useful when tracking abuse reports. The SMTP logs would show a connection from this IP address, despite whether or not the headers and sender are forged. Lastly, the senders email address is displayed once more.

How do I obtain the headers from my email client?

Depending on the Mail program being used, the process for viewing the headers will be slightly different. Below are the more commonly used mail programs.