How to View Full Internet Email Headers in Microsoft Outlook to Trace Senders

In modern corporate and personal communication, identifying the legitimacy of incoming messages is a critical security skill. Phishing attempts, spoofed sender addresses, and malicious spam campaigns frequently disguise display names to mimic trusted executives, banking institutions, or cloud services. While Outlook’s standard message window only displays the friendly sender name, subject, and date, the underlying technical metadata—known as the Internet email header—records every server hop, originating IP address, authentication verdict, and timestamp associated with the email.

What Information Do Email Headers Contain?

Internet headers act as an unalterable digital passport for electronic messages. When an email travels across the internet, each mail transfer agent (MTA) prepends a new header line. Key data points include:

• Received Fields: Detail each intermediate mail server, its IP address, and exact Coordinated Universal Time (UTC) timestamp.
• Authentication-Results: Reports whether the message successfully passed SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance).
• Return-Path: The actual technical address where bounce notifications and delivery error reports are directed, which often differs from the forged display address in phishing attacks.
• Message-ID: A unique cryptographic string assigned by the originating mail system.

Method 1: Viewing Headers in Outlook Desktop (Classic Windows Client)

To inspect full message headers in the classic desktop version of Microsoft Outlook for Windows:

1. Double-click the target email message in your inbox list to open it in its own independent window. (Headers cannot be viewed directly from the reading pane).
2. Click on the File tab located in the top-left corner of the message ribbon.
3. Ensure the Info section is highlighted on the left navigation pane.
4. Click the large Properties tile. A dialogue box titled Properties will appear.
5. At the bottom of the Properties dialogue, locate the text box labelled Internet headers.
6. Click inside the box, press Ctrl + A to select all the header text, and press Ctrl + C to copy it to your clipboard for analysis or security ticket reporting.

Method 2: Viewing Headers in Outlook on the Web and New Outlook for Windows

If you are using Outlook Web App (OWA via Microsoft 365) or the modern New Outlook client:

1. Open the message in your reading pane or double-click to view it.
2. In the top-right corner of the message display area (above the message body), click the More actions icon (represented by three horizontal dots ...).
3. Hover your cursor over View in the drop-down menu.
4. Select View message details.
5. A dedicated modal window opens instantly displaying the raw RFC 822 Internet headers.
6. Click Copy to clipboard or highlight the specific header lines you require, then click Close.

Method 3: Viewing Headers in Microsoft Outlook for Mac

On macOS running Microsoft Outlook:

1. Locate the email in your message list.
2. Right-click (or hold Control and click) on the email entry.
3. Select View Source from the context menu.
4. A text editing window opens displaying the complete raw email structure, with the header block prominently positioned at the very top.

How to Read and Decipher Header Security Flags

Once you have extracted the header block, look for these critical security indicators:

• Check the SPF Result: Look for Received-SPF: Pass. If the line reads Received-SPF: Fail or SoftFail, the sending server’s IP address was not authorised by the sender’s domain owner.
• Verify DKIM Signatures: Look for dkim=pass. A pass verdict proves the email body and headers were not altered in transit.
• Inspect the Originating IP: Trace the lowest Received: from line in the stack to find the original sending computer or outbound relay before the message entered external transit networks.