Transcript Document

Email as Text
Viewing Headers and Full
(Original or Raw) Content
John Copeland
Georgia Tech ECE 6612
Jan. 28, 2015
To see the raw email & headers in Zimbra Mail, right-click the listing.
Then, click “Show Original”
to see the email headers
Return-Path: [email protected]
Received: from (LHLO ( by with LMTP; Sun, 10 Feb 2013 11:26:02 -0500
(EST) Received: from ( []) by (Postfix) with ESMTP id
3D2CE84067F for <[email protected]>; Sun, 10 Feb 2013 11:26:02 -0500 (EST)
Received: from (localhost []) by localhost (Postfix) with SMTP id EB078DECA83 for <[email protected]>;
Sun, 10 Feb 2013 11:26:01 -0500 (EST)
Received: from ( []) by (Postfix) with SMTP id
40389DECA77 for <[email protected]>; Sun, 10 Feb 2013 11:26:00 -0500 (EST)
What to look for in the raw (“Original”) email
Last “Received:” header shows originator IP and time:
Received: from [] by;
10 Feb 2013 16:25:59 -0000
“Return-Path:” shows the full sender’s email address:
Return-Path: [email protected]
HTML links embedded in message are revealed:
{ “.mx” is the Mexico domain registry}
Zimbra: Sending email in Plain-Text Format
Outlook - to see the raw email message
To view the HTML source code of messages created or received by Outlook
Express, follow these steps:
1. Click the message whose source code you want to view.
2. Press CTRL+F2. This opens Notepad with the HTML portion of the
message displayed. The header information is not displayed.
To see the entire message source code (including the headers):
1. Click the message whose source code you want to view, and then click
Properties on the File menu.
2. On the Details tab, click Message Source. You can resize or maximize
the window to see more of the information. The content you see is the exact
information sent by the originator and is viewable only in the code page in
which it was created.
The ASCII (American Standard Code for Information Interchange) character
set defines a mapping of the letters, numerals, and specified punctuation and
control characters to the numbers from zero to 127. The term "code page" is
used to refer to extensions of the ASCII character set that also map specified
symbols to the numbers from 128 through 255.
Apple “Mail” - to see the raw email message
To see all raw text:
View > Message > Raw Source
To save raw text:
File > Save As
On drop-down menu “Raw Message Source”
To forward a message in a raw form, for investigation:
Message > Forward as Attachment
For GT received email, send to:
<[email protected]>
Eudora - to see the raw email message
Blah Blah
Return-Path: [email protected]
Received: from (LHLO ( by with LMTP; Wed, 3 Feb 2010 10:45:37 -0500 (EST)
Received: from ( [])
by (8.14.0/8.13.7) with ESMTP id o13FjUBc027007;
Wed, 3 Feb 2010 10:45:31 -0500 (EST)
Received: from User ([]) by with Microsoft SMTPSVC(6.0.3790.3959);
Wed, 3 Feb 2010 16:43:25 +0100
From: "NetSpend"<[email protected]>
Subject: Notice - Account Verification #82803-J4
Date: Wed, 3 Feb 2010 10:45:24 -0500
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251”
Content-Transfer-Encoding: 7bit
To: undisclosed-recipients:;
Email origin: .de = Germany
<x-html><!x-stuff-for-pete base="" src="" id="0" charset="Windows-1251"><html>
<div align="left"><BR>
<font face="arial" size="2"><b>Dear customer,</b><br><br>
Our records show that your online session has been locked due to the<BR>
following reason.<BR><br>
1. Log on attempts with invalid information.<br><BR>
2. Inadequate update on your cc online account.<br><br>
We urge you to restore your NetSpend online account immediately to avoid final shut down of your account.<br>
Click the link below to restore your NetSpend online account:<BR><BR></font>
<a href="">
Online Account</a></font><br>
<BR><BR> <b>© 2010 NetSpend. All rights reserved.</b>
Click -> .de = Germany
What Lies Below (dun-ump dun-ump …)
Date: Tue, 14 Feb 2012 08:31:12 -0800 (PST)
From: Chancellor Old <[email protected]>
To: [email protected]
Subject: In case you missed it
Hi Copeland,
In case our last email got lost in the shuffle, here's another link to our article on Internet
security for small business.
Click here to view ‘What Your Business Needs to Know about Internet Security.’
If you have questions, please• click here to contact us by filling out a short form, and we'll
get back to you right away.
Chancellor W. Old
If you do not wish to receive email, please Unsubscribe
-----------Net Bug - a one-pixel by one-pixel image, with 120 bytes encoded in the file name
<img src='
kdWNhdGlvbmFsIERvd25sb2FkX-100 bytes-RhdGEgUHJvdGVj width='1' height='1'
<a href='…NhdGlvE
d25sb2FkX0RhdGEgUHJvdGVjdGlvbl9CRFJfU3R-200 bytes-LmNvbS8vdGVtcC8x'
Both send Encoded data + OS + Browser type & version.
If your email program is configured to send messages as
“plain text”, then you can display a PGP or GnuPG
encrypted and/or signed file in a text editor (e.g., Notepad
or Wordpad, but not Word), and “Copy” and “Paste” it into
the email program.
-----BEGIN PGP MESSAGE----Version: GnuPG v1.4.7 (MingW32) - WinPT 1.2.0