Viewing and reading the header lines (headers) of an email
Every email has dozens of lines at the top that you don't normally see: the headers. They're added by the sender's program and by every mail server that passes the email along on its way. Together, they form the travel log of the email: where it came from, how long it was on its way and whether the recipient trusted that it really came from the sender. This article explains where to find them and how to read the most important lines.
Where do you find the headers?
| Program | How to open the headers |
|---|---|
| Webmail of WebOké (Roundcube) | Open the message, click More and choose Show source. |
| Gmail (in the browser) | Open the message, click the three dots next to Reply (More) and choose Show original. |
| Outlook (new) and Outlook on the web | Open the message, click the three dots (More actions) and choose View, View message details. |
| Outlook (classic) | Double click the message so it opens in its own window. Choose File, Properties. The headers are in the Internet headers box. |
| Apple Mail (Mac) | Select the message and in the menu choose View, Message, All headers (or Raw source for the whole message). |
| Thunderbird | Select the message and in the menu choose View, Message source, or press Ctrl+U. |
The menu names may differ slightly per version.
On an iPhone, iPad or Android phone
Apple's Mail app and most mail apps on phones can't show the headers. In that case, open the message on a computer, or log in to the webmail via webmail.weboke.nl and use More, Show source. See Opening webmail. If you use Gmail, open the message in the browser on a computer.
Reading the most important lines
A shortened example:
Return-Path: <anna@example.com>
Received: from out.hosting.example (out.hosting.example [192.0.2.25])
by mx1.mailprovider.example with ESMTPS; Sun, 08 Nov 2026 10:15:07 +0100
Received: from [198.51.100.77] by out.hosting.example with ESMTPSA
(authenticated as anna@example.com); Sun, 08 Nov 2026 10:15:04 +0100
Authentication-Results: mx1.mailprovider.example;
spf=pass smtp.mailfrom=example.com;
dkim=pass header.d=example.com;
dmarc=pass header.from=example.com
From: Anna <anna@example.com>
Subject: Offerte
Message-ID: <a1b2c3@example.com>
- Received: every server that passes the email along adds its line at the top. So read them from bottom to top to follow the journey. Each line has the form from (who offered the email), by (who accepted it) and a time. If there's a big time gap between two lines, the email was sitting in a queue there. Pay attention to the timezone too, such as
+0100or+0000. - Authentication-Results: the receiving server's verdict on SPF, DKIM and DMARC.
passmeans good,failmeans wrong,softfailmeans doubtful andnonemeans there's no record. Only trust the line written by the recipient's own server; that's the name at the front, heremx1.mailprovider.example. - Return-Path: the address where error messages go. SPF checks the domain of this address. It can be different from the address at From, the sender you see.
- Message-ID: the unique number of the email. We use it to find an email back in our logs.
Want to know exactly what SPF, DKIM and DMARC do? Read What is DMARC? Explanation in plain language.
dmarc=fail, or does a reply go to a completely different address (Reply-To)? Then the email is probably fake. Don't click any links. See Is this email really from WebOké? Recognising phishing and using the action code.Why does support ask for the headers?
If an email doesn't arrive properly, ends up in spam or you doubt whether it's genuine, the headers show us which servers the email passed through, where it got stuck and whether SPF, DKIM and DMARC checked out. With the Message-ID and the times, we can look up the email in our logs. A screenshot of the email itself doesn't show any of that.
How to include the headers
- Copy and paste: select all the headers, copy them and paste them into your ticket. In Gmail, there's a Copy to clipboard button under Show original.
- As a file: save the email as an
.emlfile (in the webmail via More, Export) and attach that file to your ticket. It contains the headers and the whole email. - Forward as attachment: simply forwarding doesn't work, because your mail program then creates new headers and the original ones are lost. So choose Forward as attachment if your program has that option. In the webmail, you'll find it under the arrow next to Forward.
Create your ticket via the Support Centre. If you want to check first yourself whether an email has arrived, use Checking whether an email has arrived with E-mail Tracing. If you received an error message, read Mail delivery failed: how to read the error message and what the codes mean.
You can find more about headers in Outlook from Microsoft, and in Gmail from Google.