Checking email headers in Outlook 2016

An email message will have "header" information that reveals the email servers it has passed through on the way from sender to recipient. The header for a message may also reveal the IP address of the sending system and antivirus and other types of servers the message has passed through on the way from sender to recipient. Viewing the email header can allow you to determine if the "from" address you see in your email client has been spoofed.

To view the header for a message in Outlook 2016, e.g, Microsoft Outlook for MAC version 15.29, right-click on the message in the left-hand pane of the Outlook window where you see a list of email messages, rather than the right-hand pane where the contents of a selected message is displayed, and select View Source.

Outlook 2016 View Source

You will then see the message header lines displayed. E.g, you might see something like the following:

Received: from NCJSCHT102.abc.example.com (192.168.5.202) by
 NCMSCHT103.abc.example.com (192.168.3.203) with Microsoft SMTP Server (TLS) id
 14.3.319.2; Mon, 20 Feb 2017 08:11:22 -0600
Received: from ncjsppt104.abc.example.com (192.168.1.198) by
 NCJSCHT102.abc.example.com (192.168.1.202) with Microsoft SMTP Server id
 14.3.319.2; Mon, 20 Feb 2017 08:11:21 -0600
Received: from pps.filterd (ndjsppt104.abc.example.com [127.0.0.1])	by
 ncjsppt104.abc.example.com (8.16.0.20/8.16.0.20) with SMTP id v1KE89xL025575	for
 ; Mon, 20 Feb 2017 08:11:21 -0600
Received: from ipss1-host77.is.centurylink.net
 (ipss1-host77.is.centurylink.net [65.127.216.77])	by ncjsppt104.abc.example.com
 with ESMTP id 28qmrghpbf-1	for ; Mon, 20 Feb
 2017 08:11:18 -0600
X-Qwest-Status: hEUBLG9ErOsrnKeZ
Received: from example.com (ncjsppt103.abc.example.com [192.168.1.197])	by
 ipss1-host77.is.centurylink.net (Postfix) with ESMTP id C38D727CDAB4	for
 ; Mon, 20 Feb 2017 14:11:14 +0000 (UTC)
Received: from ncjsppt103.abc.example.com (ncjsppt103.abc.example.com [127.0.0.1])
	by pps.ipss (8.16.0.20/8.16.0.20) with SMTP id v1KE8MAb019005	for
 ; Mon, 20 Feb 2017 08:11:13 -0600
Received: from ncjsvnpf101.abc.example.com (NCJSVNPF101.abc.example.com
 [192.168.1.151])	by ncjsppt103.abc.example.com with ESMTP id 28qnmhskbb-1	for
 ; Mon, 20 Feb 2017 08:11:13 -0600
Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=93.191.147.141; helo=dmx1.bfi0.com; envelope-from=18fee819clayfovc
iacwsg4aaaaaaadbkev6azx3p7iyaaaaa@home.dell.com; receiver=john.doe@example.com 
DKIM-Filter: OpenDKIM Filter v2.11.0 ncjsvnpf101.abc.example.com 2F0464006261
Authentication-Results: ncjsvnpf101.abc.example.com;
	dkim=fail reason="signature verification failed" (1024-bit key) header.d=home.dell.com header.i=@home.dell.com header.b="pIWltW0l"
Received: from dmx1.bfi0.com (dmailer93147141.dmx1.bfi0.com [93.191.147.141])
	by ncjsvnpf101.abc.example.com (Postfix) with ESMTP id 2F0464006261	for
 ; Mon, 20 Feb 2017 08:11:10 -0600 (CST)
DKIM-Signature: v=1; a=rsa-sha1; d=home.dell.com; s=ei; c=simple/simple;
	q=dns/txt; i=@home.dell.com; t=1487599872;
	h=From:Subject:Date:To:MIME-Version:Content-Type;
	bh=LTTKGYVZOTmoqG/5JEB+eUjGe3M=;
	b=pIWltW0lxJ4QEfUE/9Z/MVyOY6HbiMOZ2NpzonusjZh0C+/JDiNyYjEY3Lr/m4S4
	snRIKGCIm8kBaH8jxP326iLPkIDkCcHj0nZ0BBgAPvMpVgFPzBtEUeXD/J3VMxym
	g0aRdM4QGHnkbHzHMXmInzsSjZr9L2h4IU3hRYDo0sU=;
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
	s=ei; d=home.dell.com;
	h=List-Unsubscribe:Received:Reply-To:Bounces_to:Message-ID:X-SS:X-BFI:Date:From:Subject:To:MIME-Version:Content-Type;
	b=hQ+GNry2Y+f1a9QghvEBf+bJ5NEOca9NtU1cd9sCk+Guro4tgPcN3dTFJvNq6jjg
	Ysf0pne/TCEW4QQG9YLnydJSw1NkKS4tZTw/Y8IRB+BjFIOcx1kVToZxWQ75DUep
	PkPZyDIWb47E55Ng+hkVCAy5nuEMXL101K8vJa/XI5s=
List-Unsubscribe: 
Received: from [10.150.20.67] ([10.150.20.67:64696] helo=dlspvimailer27)	by
 dmx1.bfi0.com (envelope-from
 <18fee809clayfovciacwsg6aaaaaaadbkev6azx3p7iyaaaaa@home.dell.com>)	(ecelerity
 2.2.2.45 r(34222M)) with ESMTP	id D2/96-10154-009FAA85; Mon, 20 Feb 2017
 09:11:12 -0500
Reply-To: =?utf-8?B?ImRvX25vdF9yZXBseSI=?=
	<18fee819clayfovciacwsg6aaaaaaadbkev4azx3p7iyaaaaa@home.dell.com>
Bounces_to: bounce.18fee819clayfovciacwsg4aaaaaaadbkev6azx3p7iyaaaaa@home.dell.com
Message-ID: <18fee819clayfovciacwsg4aaaaaaadbkev6azx3p7iyaaaaa.18995.5569.dlspvimailer27.DumpShot.1@home.dell.com>
X-SS: 1-2-5565012-215969786
X-BFI: 18fee809clayfovciacwsg6aaaaaaadbkev6azx3p7iyaaaaa
Date: Mon, 20 Feb 2017 09:10:40 -0500
From: =?utf-8?B?RGVsbCB8IFByZXNpZGVudHMgRGF5?= 
Subject: =?utf-8?B?4piFIEl0J3MgUHJlc2lkZW50cyBEYXkhIEhpc3RvcmljIERPT1JCVVNURVIgc2F2aW5ncyB1cCB0byAkMzAwIHN0YXJ0IG5vdy7imIU=?=
To: 
MIME-Version: 1.0
	boundary="ABCD-18fee809clayfovciacwsg6aaaaaaadbkev6azx3p7iyaaaaa-EFGH"
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-02-20_13:,,
 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=95
 malwarescore=0 phishscore=0 adultscore=0 bulkscore=100 classifier=spam
 adjust=0 reason=mlx scancount=1 engine=8.0.1-1612050000
 definitions=main-1702200140
X-Proofpoint-Envelope-Sender: 18fee819clayfovciacwsg4aaaaaaadbkev6azx3p7iyaaaaa@home.dell.com
Return-Path: 18fee819clayfovciacwsg4aaaaaaadbkev4azx3p7iyaaaaa@home.dell.com
X-MS-Exchange-Organization-AuthSource: NCJSCHT102.abc.example.com
X-MS-Exchange-Organization-AuthAs: Anonymous
Content-type: multipart/alternative;
	boundary="B_3570604935_434891138"