Search the header list#

Every header the message carries sits in one of four groups, and the search box narrows the list on names or values as you type.

The Overview tab opens first when you load a message. It lists every header that the message carries. It groups the headers, so a long message stays readable, and a search box filters the list as you type. Use the tab when you want the raw ground truth: the exact value of a single header, as the servers wrote it.

The four header groups#

Email Forensics puts the headers into four sections. The sections keep the identity fields clear of provider noise:

  • Basic holds the core identity fields: date, from, to, and subject.
  • Content describes the message body: the content type with its multipart boundary, and the MIME version.
  • IDs holds the message identifiers, such as the message ID.
  • Other holds everything else: authentication headers, provider X- headers, threading metadata, language tags, and any custom headers added along the way.

Each row shows the header name with its decoded value underneath. Long values, such as ARC signatures and base64 blobs, wrap onto several lines. The end of a value never disappears off the side of the pane.

Filter and search the list#

The four buttons to the right of the search box turn each section on or off. Switch off Other to hide the provider headers and to keep the identity fields in view. At least one section always stays on. A counter shows how many headers are visible against the total.

The search box filters the whole list live. It matches on both header names and values, so you can find a header by an exact name, or by a fragment of its content such as a domain or an identifier. Clear the box to return to the full list. If nothing matches, the tab shows No matching headers found with a button to reset the filters.

Where to read parsed values#

The Overview tab shows authentication headers as raw text. To read them parsed, tag by tag, with a verdict on each, switch to the Security tab. To walk the Received headers as a route rather than a list, use the Routing tab.

Related screenshots#

The following screenshot appears elsewhere in the docs. This page does not repeat it:

  • Overview: the Overview tab with the header list grouped into Basic, Content, IDs, and Other, and the search box across the top.