Extracting header information from an email

If you’ve received a phishing email or other email scam, you can find details of who sent it to you in the email’s header information.

When you report a phishing or other email scam to us, we might ask you to:

  • extract the header information from the email you received, and 
  • send it to us for analysis.

Here’s how to do that using some common email clients.

Gmail

  1. Open the email message.
  2. Click the down arrow next to the Reply button in the upper-right hand corner of the email message.
  3. Click Show Original.
  4. Copy and paste the information you see into an email  to PNGCERT.

Outlook 2016, 2013, or 2010

  1. In an open email message, click the File tab.
  2. On the Info tab, click Properties. The header information appears in the Internet headers box.
  3. Copy and paste the header information into an email to PNGCERT.

AppleMail

  1. Choose Mail > Preferences, click Viewing, then select ‘Show additional message headers’.
  2. Copy and paste the header information into an email to PNGCERT.

Xtra (Spark)

  1. Open the email message.
  2. Click the three horizontal lines next to the Delete button in the upper-right hand corner of the email message.
  3. Click View source.
  4. Copy and paste the information you see into an email to PNGCERT.
Visit CERT NZ for more information. 
Visit ACSC for more information.