Extracting email headers shows the message’s exact routing path without requiring you to download or open any malicious attachments. Here is how to safely view and copy them from the most common email clients:

Microsoft Outlook (Desktop App)

1. Double-click the suspicious email to open it in a new window.
2. Click File in the top-left corner.
3. Click the Properties button (usually located at the bottom of the Info screen).
4. Locate the Internet headers box at the bottom of the pop-up.
5. Click inside the box, press Ctrl + A to select all, and Ctrl + C to copy.

Microsoft Outlook (Web/Browser version)

1. Click on the suspicious email to view it in the reading pane.
2. Click the three dots (…) menu icon in the upper-right corner of the email window (next to the Reply buttons).
3. Hover over View or More Actions, then select View message details.
4. A popup window will appear with the headers. Select all the text and copy it.

Gmail (Web Browser)

1. Open the suspicious email.
2. Click the three vertical dots (…) next to the Reply button on the right side of the email pane.
3. Click Show original.
4. A new tab will open. You can click the blue Copy to clipboard button to copy the entire header block instantly.

Apple Mail (Mac)

1. Click on the suspicious email to select it.
2. Go to the top menu bar and select View.
3. Hover over Message, then select Raw Source (or press Option + Command + U).
4. A window will open showing the code. Press Command + A to select all, and Command + C to copy.

Google Android / Apple iOS Mail Apps

• Limitation: Most native mobile email apps (like the standard iOS Mail app or the Gmail mobile app) do not allow you to view or copy raw email headers directly on a phone.
• Safe Practice: To extract headers for a report, log into your email account via a desktop computer or web browser instead. Do not forward the email to yourself to check it on a desktop, as forwarding overwrites the original header information.