How to Find and Read Full Email Headers for Diagnostics

This is a reference guide to the full email headers, the hidden technical record that every message carries alongside the part you normally read. When an email is delayed, lands in spam, appears to be forged, or bounces for no obvious reason, the headers are where the answer lives: they show every server the message passed through, the exact times it did so, and the verdicts on whether the sender was genuine. This article shows you how to reveal those headers, sometimes called the message source, raw source, original or internet headers, in the mail programmes people actually use with a Noiz mailbox: Plesk Roundcube webmail, Microsoft Outlook (both the classic and the new versions), Mozilla Thunderbird, Apple Mail and Gmail on the web. It then explains, in plain language, what the important lines mean, and how to hand a complete, useful copy to the Noiz support team so a problem can be traced quickly.

You do not need to understand every line to benefit from this. Even copying the full headers correctly and sending them on is a real help, because the header block is the single richest piece of evidence about what happened to a message. Wherever you see yourdomain.com below, replace it with your own domain; it is only an example.

Last reviewed: 27 July 2026, against the current stable versions of Plesk Roundcube webmail, Microsoft Outlook (classic and new for Windows), Outlook on the web, Mozilla Thunderbird, Apple Mail and Gmail on the web. This guide is written for Noiz hosting and complements, and does not replace, each vendor's own documentation linked below. Email clients redesign their menus often, so if a button sits somewhere slightly different from the description here, the feature and the header content it reveals are the same; look for the wording given rather than the exact location.

Official Documentation Reference

• Microsoft: View internet message headers in Outlook, covering the classic desktop, new Outlook for Windows and Outlook on the web.
• Google: Trace an email with its full header, the reference for Gmail on the web.
• Google Admin Toolbox Messageheader, a free analyser that turns a pasted header block into a readable timeline of hops and delays.
• Mozilla Thunderbird Support, the official support hub for the desktop client.
• Apple Mail User Guide (macOS), the official reference for the Mail app.
• RFC 5322: Internet Message Format, the open standard that defines what email headers are and how they are structured.

Prerequisites

• The message you want to inspect is in front of you in one of the clients below. You are reading the message itself, not a forwarded summary of it (a forward usually strips the original headers away, as explained in Troubleshooting).
• For the webmail method, you can access your email from Plesk webmail. Noiz webmail is Roundcube.
• You know which direction the problem runs: a message that arrived into your Noiz mailbox, or one you sent that went astray. This decides whose copy of the headers is useful, and it is the single most common thing people get wrong. See the next section.

Why Full Headers Matter, and Which Copy to Use

The body of an email is written by the sender and proves nothing about where the message really came from. The headers are added and stamped by the mail servers that handle the message, which is why they can answer questions the body cannot:

• Tracing the path a message took. Every server that relays a message adds its own Received: line at the top. Reading that stack tells you exactly which systems the message travelled through, in order, and the timestamp on each hop lets you see where a delay was introduced.
• Diagnosing spam and spoofing. The receiving server records whether the sender passed the three sender-authentication checks, SPF, DKIM and DMARC, and whether the visible From: address matches the address the server actually accepted the mail from. A forged message very often fails one of these or shows a mismatch, and the headers make that visible.
• Explaining delivery delays. If mail arrived hours late, the gaps between the timestamps on successive Received: lines show which hop held the message up, so the problem can be pinned to the right side.

The critical point about which copy to capture. Headers describe the journey up to the point where they are read, so you must capture them from the copy at the destination end of the problem:

• For a message that arrived badly (unwanted, forged, or delayed) into your Noiz mailbox, open your own copy of that message and read its headers. This is the normal case, and everything below applies directly.
• For a message you sent that was marked as spam, delayed or rejected at the far end, your own Sent copy is of little use: it only shows the message leaving. The evidence lives in the recipient's copy. Ask the recipient to open the message they received, capture its full headers using the matching instructions below, and send those to you. Without the recipient-side headers, an outbound delivery problem is very hard to trace.

Reveal the Full Headers in Each Client

Find your mail programme below. In every case the goal is the same: the complete raw source of the message, meaning the entire header block from top to bottom (not just the four or five lines shown in the normal message view).

Plesk Roundcube Webmail (Noiz Webmail)

1. Sign in to your Noiz webmail and open the message so it fills the reading area.
2. In the message toolbar, open the More menu (shown as three dots, …, or a More button depending on the window width).
3. Choose Show source. The complete raw message, headers first, opens in a new browser tab.
4. Select all of the text on that tab (Ctrl+A, or Cmd+A on a Mac) and copy it. Some Roundcube versions also offer a Download option in the same More menu, which saves the message as a .eml file; that file is the cleanest thing to attach to a support ticket.

Microsoft Outlook, Classic Desktop

1. Double-click the message in the list so it opens in its own window (the header option is not available while the message is only previewed in the reading pane).
2. Click File, then Properties.
3. The full header text appears in the Internet headers box near the bottom of the Properties window. Click inside the box, select all of the text and copy it.

Note that the Internet headers box shows the header block only, which is exactly what is needed for diagnosis; it does not include the message body.

New Outlook for Windows, and Outlook on the Web

The new Outlook app and Outlook on the web (Outlook.com and Microsoft 365 webmail) share the same steps:

1. Open the message.
2. Select More actions at the top of the message (the three-dots icon).
3. Choose View, then View message details. The header block appears in a panel; select all of it and copy it. Scroll within the panel to be sure you have captured every line.

Mozilla Thunderbird

1. Select or open the message.
2. Press Ctrl+U (Windows and Linux) or Cmd+U (Mac), or use the menu path View › Message Source. You can also right-click the message and choose View Source.
3. The raw source opens in its own window. Select all and copy, or use File › Save As to keep it as a .eml file.

If your Noiz account is not yet in Thunderbird, set it up first with How to Add an Email Account in Mozilla Thunderbird, then return here.

Apple Mail on macOS

1. Select the message in Mail.
2. For the complete raw source, use the menu path View › Message › Raw Source (keyboard shortcut Option+Cmd+U). This shows every header and the body exactly as received.
3. To expand just the headers within the normal message view instead, use View › Message › All Headers (Shift+Cmd+H). For a support ticket, Raw Source is the better choice because it is complete and easy to copy in full.

On an iPhone or iPad, the built-in Mail app has no option to display raw headers. The simplest route is to open the same mailbox in Plesk webmail on the device's browser and use the Roundcube steps above, or to view the message on a computer. If you are configuring mail on an iOS device, see How to Set Up Email on iPhone or iPad.

Gmail on the Web

1. Open the message.
2. Click the More menu (the three dots) at the top right of the message, next to the reply arrow, and choose Show original.
3. A new tab opens showing the full source, with a summary panel at the top that reports the SPF, DKIM and DMARC results. Use Copy to clipboard to grab the whole thing, or Download Original to save it as a file.

Reading the Key Header Lines

Once you can see the raw source, a handful of lines carry most of the diagnostic value. Headers are listed with the newest at the top, so the very first lines were added last, by the server closest to delivery.

• Received: the journey, one line per hop. Each server that handled the message inserted its own Received: line above the previous one. Read the block from the bottom upward to follow the message in the order it actually travelled: the bottom line is the first sending server, the top line is the last server before it reached the mailbox. Each line carries a timestamp, so the gaps between them reveal where any delay occurred.
• Return-Path: the envelope sender, also called the bounce address. This is the address the receiving server actually accepted the mail from, and it is what SPF is checked against. It is not always the same as the visible From: address, and a large mismatch is a common sign of forged or bulk mail.
• From: and Reply-To: the sender and reply address you see in the client. These are written by the sender and can be set to anything, so on their own they prove nothing; their value comes from comparing them against the authentication results and the Return-Path:.
• Authentication-Results: the verdict on the sender, added by the receiving server. This single line usually reports all three checks, for example spf=pass, dkim=pass and dmarc=pass. A fail or softfail on SPF or DKIM, or a dmarc=fail, is the clearest signal that a message may be spoofed or was not properly authorised by the domain it claims to be from.
• DKIM-Signature: the cryptographic signature the sending domain attached. You do not read this by eye; the dkim= result in Authentication-Results: is the plain-language outcome of verifying it.
• Message-ID: a unique identifier for the message. Quote this to support: it lets the team find the exact message in the server logs.
• Date: when the sender's system says the message was composed. Compare it with the Received: timestamps to sanity-check timing.
• X- headers such as X-Spam-Status, X-Spam-Score or X-Mailer: are optional extras added by mail software. Spam-scoring headers can show why a filter treated a message the way it did.

Here is a shortened, sanitised example of the top of a header block, with the values replaced by examples. It shows the shape to look for rather than any real message:

Return-Path: <[email protected]>
Received: from mail.yourdomain.com (localhost [127.0.0.1])
    by mail.yourdomain.com with LMTP
    for <[email protected]>; Tue, 21 Jul 2026 10:15:04 +0200
Received: from mx.example.net (mx.example.net [198.51.100.20])
    by mail.yourdomain.com with ESMTPS
    for <[email protected]>; Tue, 21 Jul 2026 10:15:02 +0200
Authentication-Results: mail.yourdomain.com;
    spf=pass smtp.mailfrom=example.net;
    dkim=pass header.d=example.net;
    dmarc=pass header.from=example.net
From: "Example News" <[email protected]>
Message-ID: <[email protected]>
Date: Tue, 21 Jul 2026 10:15:01 +0200
Subject: Your weekly update

Reading it: the lower Received: line is the sending server mx.example.net handing the message to the Noiz mail server; the upper one is the Noiz server delivering it to the mailbox two seconds later. The Authentication-Results: line, stamped by the receiving Noiz server, shows all three checks passing, and the Return-Path: domain matches the visible From: domain. That combination is what a legitimate, well-authenticated message looks like. A spoof would typically show an authentication fail, or a Return-Path: and From: that disagree.

If you want a friendlier view than raw text, paste the copied header block into the Google Admin Toolbox Messageheader tool, which lays the hops out as a timeline and highlights the delay at each step. It reads only what you paste and needs no sign-in.

How to Send the Headers to Noiz Support

The value of headers depends entirely on sending them whole. A screenshot of a few lines, or the visible From and Subject, is not enough to trace anything. When you open a ticket:

• Send the complete raw source, not a partial copy. Use the client's own Show source, Internet headers, View message details, Message Source, Raw Source or Show original output described above, and include all of it. The best format of all is the message saved as a .eml file and attached to the ticket, because it preserves every header exactly; Roundcube, Thunderbird and Gmail can all produce one.
• Do not edit or redact the headers. People sometimes remove IP addresses or the Received: lines to tidy them up, but those are precisely the parts that make tracing possible. Leave them intact.
• State the direction and the details. Say whether the message arrived into your Noiz mailbox or was sent from it, give the affected mailbox address, the approximate date and time with your timezone (Noiz mail timestamps are in +0200, South African time), and paste or quote the Message-ID:. For an outbound problem, remember the headers must come from the recipient's copy, not your Sent copy.

If you suspect a wider spam problem rather than a single message, the companion guide How to determine the source of spam and reduce it walks through using headers to identify where unwanted mail is coming from and how to cut it down.

Troubleshooting

• Symptom: you cannot find the header or source option. In Outlook, make sure the message is open in its own window, not just previewed in the reading pane, then use File › Properties (classic) or More actions › View › View message details (new Outlook and web). In other clients, look for a More or three-dots menu on the open message. If the client is very old, update it; the wording above matches current versions.
• Symptom: the copied text is only a few lines long. You copied the short summary shown in the normal view rather than the raw source. Reopen using the exact source or raw option for your client and select the entire window contents. A genuine header block for a normal message runs to dozens of lines.
• Symptom: an iPhone or iPad will not show the headers. The iOS Mail app cannot display raw source. Open the same mailbox in Plesk webmail through the device's browser and use the Roundcube Show source steps, or view the message on a computer.
• Symptom: you forwarded the problem message to support and the headers were gone. A normal forward rewrites the message and discards the original headers. Instead, forward the message as an attachment (most clients offer Forward as Attachment), or attach the saved .eml file, so the original headers survive intact.
• Symptom: the authentication results are blank or missing. Not every server stamps an Authentication-Results: line, and a message that never left a single system may not have one. In that case the Received: chain and the Return-Path: are still useful, so send the whole source and let support interpret it.

Reading headers is a skill, and there is no need to master it to get help. If a message is behaving strangely, capture the full raw source using the steps for your client, attach it to a ticket with the Noiz support team, and note whether it was incoming or outgoing along with the time it happened. On Noiz managed plans the team can line your headers up against the mail server logs and tell you exactly what the servers saw, which is the fastest way to settle a delivery, spam or spoofing question.