Viewing Full Headers
Viewing your message headers is like looking at the map that your email takes when being delivered to your mailbox. Understandably this map is very helpful in finding out the causes for many email problems that can be experienced on any system. From delayed mail to email bounces, headers are the number one clue in troubleshooting.
Understanding Message Headers
By default, mail clients will only show you the basic headers of a message:
From: email@example.com To: firstname.lastname@example.org Date: Mon, 7 Jan 2013 21:33:51 -0800 (PST) Subject: This is just a test
This information is useful, but it is not all the information that you actually have access to. In your mail client, you can select a message then choose to view the messages full headers or some even call it long headers:
Delivered-To: email@example.com Received: by 10.217.57.72 with SMTP id z50csp118457wew; Mon, 7 Jan 2013 21:33:53 -0800 (PST) X-Received: by 10.68.237.167 with SMTP id vd7mr195354074pbc.161.1357623232688; Mon, 07 Jan 2013 21:33:52 -0800 (PST) Return-Path: <firstname.lastname@example.org> Received: from irv-vsguest-relay1.dreamhost.com (irv-vsguest-relay1.dreamhost.com. [220.127.116.11]) by mx.google.com with ESMTP id pu7si29919623pbc.247.2013.01.07.21.33.52; Mon, 07 Jan 2013 21:33:52 -0800 (PST) Received-SPF: pass (google.com: domain of email@example.com designates 18.104.22.168 as permitted sender) client-ip=22.214.171.124; Authentication-Results: mx.google.com; spf=pass (google.com: domain of firstname.lastname@example.org designates 126.96.36.199 as permitted sender) email@example.com Received: from tienkwan.dreamhost.com (tienkwan.dreamhost.com [188.8.131.52]) by irv-vsguest-relay1.dreamhost.com (Postfix) with ESMTP id 79DB7187AE3D88 for <firstname.lastname@example.org>; Mon, 7 Jan 2013 21:37:14 -0800 (PST) Received: by tienkwan.dreamhost.com (Postfix, from userid 13239796) id 00D573A0113; Mon, 7 Jan 2013 21:33:51 -0800 (PST) To: email@example.com Subject: This is just a test Message-Id: <20130108053352.00D573A0113@tienkwan.dreamhost.com> Date: Mon, 7 Jan 2013 21:33:51 -0800 (PST) From: firstname.lastname@example.org
This information has kind of an odd trait. You must read it from the bottom up to see the path of the message. So the first line shows where the email was created and originally sent from, and each 'Received' line is a link in the chain the email passed through on its way to the recipient. If just looking at this gives you a headache, pass it along to support as this will soon be required information for all email related problems dealing with delayed or bounced messages.
Your headers may not look exactly like the above created example, but it will have all the basic information. It will have Received by and Received from information as well as letting us know what servers and the date and time of the delivery from each server. It will also show you the timezone the servers it passes through are using.
Google Apps Toolbox Message Header Analyzer can display in a table all the information about the servers the email passed through. Just paste in the whole header and it will sort through it and display it all in a table that is much easier to read.
Viewing headers in your mail program
You can find more details on how to view full headers depending on what email client you use at the following sites:
- multiple clients: http://kb.iu.edu/data/adix.html.
- many webmail and desktop clients: http://support.google.com/mail/answer/22454?hl=en
- multiple (older) clients: http://spamcop.net/fom-serve/cache/19.html.
- Microsoft Outlook 2000 - 2003: http://email.about.com/od/outlooktips/qt/How_to_View_All_Message_Headers_in_Outlook.htm
- Microsoft Outlook 2003 & 2007: http://8help.osu.edu/2414.html.
Bounced or Undeliverable Notification Headers
When you receive a bounced email that says an email could not be delivered, you generally want to look at the headers of the email that could not be delivered, not the headers of the bounce notification. Inside the bounce notification is the error message detailing where and how the email could not be sent. A copy of the original email that could not be delivered is usually included, either below the error message or as an attachment. The headers of that email will show how the original email was sent and help diagnose the cause, such as spoofing.