Email Evidence

How to get raw headers or full message source

If you want useful phishing or delivery analysis, paste the original evidence. Screenshots, forwarded copies, and retyped sender details remove the routing data that matters.

Quick rule

Desktop or webmail is usually the right place

Several mobile mail apps do not expose copyable raw headers. When that happens, open the same mailbox in a desktop browser or desktop client and copy the source there.

If you only have the message on a phone, first check whether the app has a built-in View headers, Show original, or View message source action. If not, switch to the provider's webmail or desktop app before pasting into the analyzer.
Major Platforms

Copy the original headers from the mail platform

These paths are based on the providers' current support flows.

Google

Gmail or Google Workspace

  • Open the message in Gmail in a browser.Use desktop webmail, not the mobile app.
  • Open the More menu next to Reply.Choose Show original.
  • Copy the source.Use the built-in copy action, then paste it into the tool.
Microsoft

Outlook.com, Outlook on the web, or new Outlook

  • Open the message window.Use Outlook.com or Outlook on the web in a browser, or new Outlook on desktop.
  • Open More actions.Select View and then View message details.
  • Copy the headers.Paste the message details into the analyzer.
Microsoft

Classic Outlook for Windows

  • Open the email in its own window.Do not stay only in the preview pane.
  • Open message properties.Go to File and then Properties.
  • Copy Internet headers.Paste the header block into the analyzer.
Apple

Mail on Mac

  • Open Apple Mail on macOS.Select the original message.
  • Show detailed headers.Choose View then Message then All Headers.
  • Copy the visible header block.Paste it into Email Inspector or Phishing Check.
Apple

Mail on iCloud.com

  • Open iCloud Mail in a browser.Select the message you want to inspect.
  • Open the More menu.Choose Show All Headers.
  • Copy the expanded headers.Paste them directly into the analyzer.
Yahoo

Yahoo Mail

  • Open the message in Yahoo Mail.Use the full web interface.
  • Open More options.Select View Raw Message.
  • Copy the raw output.Paste the full header or source into the analyzer.
AOL

AOL Mail

  • Open the message in AOL Mail.Use the web interface for the original mailbox.
  • Open More.Select View Raw Message.
  • Copy the raw message.Paste it directly into the analyzer.
Proton

Proton Mail on the web

  • Open the message at mail.proton.me.Use the original message, not a forwarded copy.
  • Open the three-dot menu.Select View headers.
  • Download or copy the result.Proton exposes the headers directly in a pop-up.
Proton iOS

Proton Mail on iPhone or iPad

  • Open the original message in the Proton Mail app.This is one of the few mobile clients that documents header access directly.
  • Open the three-dot menu.Select View Headers.
  • Share or copy the output.Then paste it into the analyzer.
Mobile Reality

What to do on phones and tablets

Some popular mobile clients simply are not good evidence-export tools.

Gmail App

Android or iPhone Gmail app

Google's header-copy instructions are documented for Gmail in a browser. If you only have the Gmail mobile app, open the same mailbox in desktop web Gmail and use Show original.

Outlook Mobile

Outlook for iOS or Android

Microsoft documents message-header access for Outlook.com, Outlook on the web, new Outlook, and classic Outlook for Windows. If you are on the mobile app, switch to Outlook on the web or desktop Outlook to copy the real headers.

Apple Mail iOS

iPhone or iPad Mail app

Apple documents detailed headers in Mail on Mac and on iCloud.com, not as a simple raw-header export flow in the native iPhone or iPad Mail app. For reliable evidence, open the same message in Mail on Mac or iCloud Mail on the web.

Proton Android

Proton Mail on Android

Proton's current Android app documentation says viewing message headers is not yet available in the latest version. If you need raw headers, use Proton Mail on the web instead of forwarding the message out of the app.

Android Mail Clients

Samsung Mail or other Android mail apps

Android mail clients vary by vendor. If you do not see a direct View source, Show original, or View headers action in the message menu, use the provider's webmail or desktop client instead of pasting a forwarded copy.

Before You Paste

Keep the evidence intact

  • Use the original message.Forwarding often rewrites headers and breaks the delivery trail.
  • Prefer raw source over screenshots.The tools need actual text to parse SPF, DKIM, DMARC, URLs, and routing history.
  • Paste only what is needed.Headers alone are often enough. Use the full source when you also want link or lure analysis.