How to View Email Properties in Gmail to Find Out Where that Email Really Came From

How to View Email Properties in Gmail to Find Out Where that Email Really Came From

Sometimes, especially when it comes to spam and phishing email the sender’s email address is forged. That means it didn’t come from the address that it appears to have come from. Spammers, scammers, and criminals are usually experts at forging email addresses. The only way to tell where a suspicious email came from is by digging deep into an email’s headers and the properties of an email.

If you’ve ever wondered how to view the properties of an email you’ve received in Gmail, and you view your mail on the Gmail web site, here’s an easy way to see the complete headers and properties of any email.

From your inbox, select any email of which you want to view the properties. Look right above the email, to the far right  (to the right of the email time and the return arrow). Click on the down arrow ( below in the red box) to expand the drop-down menu. From the drop-down menu, click on “Show original” (see image below).

When you click on “Show original” you’ll see the following. It will show the sender’s name,  email address, time and date of the email and other information.  It will show an SPF record. This SPF has nothing to do with sunscreen:). This type of SPF record is a type of Domain Name Service (DNS) record that identifies which mail servers are permitted to send an email on behalf of your domain.

You’ll also see information about DKIM and DMARC. You’re probably not going to be too interested in those, but if you are and you want to learn more about them you can click on the “Learn more” links when you’re viewing this information on Gmail. If you can’t wait, you can read more about DKIM here; you can read more about DMARC here.

Beneath this information, you’ll see two buttons. One says “Download Original” and the other says “Copy to Clipboard”.

They both give you the same information… that is the complete email, headers, properties, and body of the email. They way they are delivered to you differs. If you click on Download Original a text document with all the email headers, properties, and message body will be downloaded to your computer. If you choose Copy to clipboard, the entire message headers, properties, and message body will be copied to your clipboard. You can then open up Notepad, WordPad or any word processor and paste the contents of your clipboard to it by pressing the CTRL + V keys.

Having the headers and properties of an email can help you identify the real origin of scam, spam and phishing emails.  But we warn you upfront: It’s no picnic trying to decipher email properties.

But if you dig deep enough and you know what to look for, you can determine the real origin of any email. You may have to dig down several layers though. Spammers and other miscreants can fake email headers. But they cannot completely hide the email’s origin. With a little reading and learning and a lot of patience, you can use the information in the properties of an email to find out who really sent it and where it really came from.

There are several sites that allow you to paste in the email’s header and properties to help you determine the real origin of an email. They are not always accurate, but here’s one you can try.