Finding the real sender: raw headers in Gmail, Outlook and Apple Mail

By MercPrivacy · Published 2026-06-07 · Updated 2026-08-05

The From line is typed by the sender; the raw headers record what actually happened. Step-by-step paths in Gmail, Outlook and Apple Mail, the five lines that matter, and how to preserve the file.

Every email arrives wearing a name tag, and the name tag is the least trustworthy thing about it. The From line is typed by the sender, the way a return address is handwritten on an envelope. Nothing at the mailbox slot checks it. What actually happened — which server sent the message, what path it took, whether it carries valid credentials — is recorded in the full headers, a block of text your mail client hides by default.

If you are dealing with spam that lies about who sent it, the headers are where the lie is documented. They are also the difference between "I got a shady email" and evidence someone can actually use. Several state email laws turn specifically on falsified headers, so knowing how to pull them is not a party trick. It is preservation.

The good news: every major client will show you the raw message. The menus just hide the door.

## Gmail

1. **Open the message**, then click the three-dot menu at the top right of the message itself, not the inbox toolbar. 2. **Choose Show original.** A new tab opens with a summary table — sender, message ID, and the SPF, DKIM and DMARC verdicts — followed by the complete raw source. 3. **Click Download Original** to save the message as a file, usually with an .eml extension. That file is the full message with headers intact. Keep it somewhere deliberate.

Gmail's summary table is the friendliest authentication readout in the business. If you only learn one client's path, learn this one.

## Outlook

- **Outlook on the web** — open the message, click the three-dot menu in the message's top corner, then View, then View message source. Copy the text into a file and save it. - **Outlook desktop (classic)** — double-click the message so it opens in its own window, then File, then Properties. The Internet headers box at the bottom holds the header block. It is cramped; click into it, select all, copy, and paste into a text file. - **Saving the full message** — drag the message from the list into a folder on your desktop, or use File then Save As. Depending on version Outlook saves .msg or .eml; either preserves the headers.

Menus shuffle between Outlook versions, but the words to hunt for stay the same: source, properties, internet headers.

## Apple Mail

1. **Select the message**, then from the menu bar choose View, then Message, then All Headers. The full header block expands in place. 2. **For the complete raw file**, choose View, then Message, then Raw Source. That is the entire artifact, exactly as received. 3. **To preserve it**, use File then Save As and choose Raw Message Source, or simply drag the message out of Mail into a folder — macOS writes an .eml file.

## Which lines actually matter

A raw header block looks like machine noise, and most of it is. These are the lines worth reading.

- **From** — the display line. Anyone can type anything here. Treat it as a claim, not a fact. - **Return-Path** — the envelope address the message was actually sent on behalf of, where bounces go. When Return-Path and From point at unrelated domains, ask why. - **Reply-To** — where your reply would actually go. Scammers routinely display one identity in From and harvest replies at a different address entirely. - **Received** — a chain of server hops, newest at the top. Each honest server stamps the message like a passport. A forger can pre-load fake entries at the bottom of the chain, so the trustworthy stamps are the upper ones, added after the message reached real infrastructure. - **Authentication-Results** — the receiving system's verdict on SPF, DKIM and DMARC, written in compact form: spf=pass, dkim=fail, dmarc=none. This one line is the closest thing headers have to a lie detector. What the three checks actually mean is its own short read: [SPF, DKIM and DMARC in plain English](https://mercprivacy.com/knowledge/spf-dkim-dmarc-plain-english).

> The From line is a costume. The headers are the receipts.

## Preserve the file, not just the picture

A screenshot shows what an email looked like. It proves very little about where the message came from, and it drops every header. If a message may matter later — because the sender is a repeat offender, because the headers are forged, because it fits a pattern — save the original file.

- **Save the .eml or .msg**, using the steps above, into a folder you keep for exactly this purpose. - **Do not forward it to yourself** as a preservation method. Forwarding rewrites the headers; the copy documents your forward, not the original transit. - **Note the context** — one line in a text file about when it arrived and which account received it costs you thirty seconds and saves an argument later.

This is the same discipline we preach for calls and texts in [the evidence file](https://mercprivacy.com/knowledge/the-evidence-file-what-to-keep): the record you keep on the day is the only record that exists later. Forged headers preserved in original files are what turn an annoyance into something [the state falsity laws can reach](https://mercprivacy.com/knowledge/state-spam-laws-that-still-pay).

## When you find something ugly

If the headers show failed authentication and a borrowed identity, you are no longer looking at marketing — you are looking at deception in writing. [Stephanie](https://mercprivacy.com/stephanie) can tell you instantly and free whether what you have preserved is filter fodder or a pattern worth pursuing, and a call to (830) 587-5011 reaches a person. We are not a law firm; when a matter requires legal representation, a licensed attorney is engaged.