How to Check Outlook Security Headers in 2026
Outlook security headers reveal how an email was authenticated, routed, and protected before it reached your inbox.
If you know where to look, they can help you spot spoofing, diagnose delivery issues, and understand why a message was marked as suspicious.
What Outlook security headers are
Security headers are metadata added to an email as it travels through mail servers.
In Microsoft Outlook, you usually inspect the full internet headers to see details such as SPF, DKIM, DMARC, authentication results, message IDs, routing hops, and encryption-related information.
These headers do not change the visible message body, but they provide the technical evidence behind how the message was handled.
That makes them useful for IT teams, security analysts, and anyone investigating phishing or mail delivery problems.
How to check Outlook security headers?
The method depends on whether you use Outlook for Windows, Outlook on the web, or Outlook for Mac.
In all cases, you are looking for the full message headers, sometimes called internet headers or message properties.
In Outlook for Windows
- Open the email.
- Select File.
- Choose Properties.
- Look for the Internet headers box.
- Copy the header text for analysis.
This is the most direct way to inspect message headers in the classic Outlook desktop app.
If the message is suspicious, copy the full header text into a secure text editor or a mail analysis tool.
In Outlook on the web
- Open the email.
- Select the More actions menu, often shown as three dots.
- Choose View or View message details, depending on your version.
- Review the full message headers.
Microsoft 365 and Exchange Online interfaces can vary by tenant and update cycle, so the exact wording may differ.
The goal is the same: access the raw technical details attached to the message.
In Outlook for Mac
- Open the message.
- Select View.
- Choose Message and then All Headers, or open the message source if available.
If your version of Outlook for Mac does not show the same menu labels, look for a message details or source view.
Microsoft periodically changes the UI across Outlook platforms.
Which headers matter most?
Not every header is useful for security review.
Focus on the fields that identify sender authenticity, mail path, and policy decisions.
Authentication-Results
The Authentication-Results header shows the outcome of checks such as SPF, DKIM, and DMARC.
This is often the first place to look when verifying whether a sender passed domain authentication.
Common indicators include:
- spf=pass or spf=fail
- dkim=pass or dkim=fail
- dmarc=pass or dmarc=fail
If the header shows a failure, it does not automatically mean the email is malicious, but it does mean the message did not meet the expected authentication policy.
Received
The Received headers show each mail server hop from sender to recipient.
They help you trace the path of a message and identify unusual relays or unexpected infrastructure.
Look for:
- Unexpected geographic locations
- Mail servers that do not belong to the claimed sender
- Long or inconsistent routing chains
Attackers often try to hide behind compromised infrastructure or poorly configured relays, so the path can be just as important as the sender address.
From, Return-Path, and Reply-To
The From address is what users see, but it is not always the same as the envelope sender or the reply target.
Compare it with Return-Path and Reply-To to find mismatches.
Mismatched identity fields can indicate impersonation, forwarded mail, or a phishing attempt.
A legitimate vendor email may still use different technical addresses, but the differences should make sense in context.
Message-ID
The Message-ID is a unique identifier assigned to the email.
It can help correlate logs across mail gateways, Exchange Online, Microsoft Defender for Office 365, or third-party security tools.
If you are investigating a repeated phishing campaign, Message-ID values can help determine whether multiple recipients received copies of the same message or whether a message was altered in transit.
X-MS and Microsoft-specific headers
Microsoft mail systems often add X-MS-Exchange-* or related headers.
These can show transport decisions, malware scanning, spam filtering, and whether the message was processed by Exchange Online Protection.
Examples include indicators for:
- Spam confidence scoring
- Transport rules
- Quarantine actions
- Message trace identifiers
These headers are especially useful in Microsoft 365 environments because they reveal how Microsoft’s security stack handled the message before delivery.
How do you interpret SPF, DKIM, and DMARC results?
SPF, DKIM, and DMARC work together to verify that a message is allowed to send for a domain and has not been altered in transit.
In Outlook headers, you usually see their results in the Authentication-Results line.
- SPF checks whether the sending server is authorized by the domain’s DNS record.
- DKIM checks whether the message was digitally signed and whether the signature is valid.
- DMARC checks whether SPF or DKIM align with the visible From domain.
A message can pass DKIM but fail DMARC if the domain used in the signature does not align with the From address.
Similarly, a forwarded message may fail SPF even if it is legitimate, because forwarding changes the sending path.
What red flags should you look for?
Security headers are most valuable when you know what looks abnormal.
The following patterns often deserve extra scrutiny.
- Authentication failures for a brand or vendor that normally uses strict email authentication
- Unexpected relay servers in the Received chain
- Multiple Reply-To changes that point to unrelated domains
- Fake display names with mismatched sending domains
- Missing DKIM signatures on messages that should be signed
- Unusual time gaps between hops that suggest rerouting or filtering delays
One suspicious field does not prove fraud.
The strongest assessment comes from combining headers, sender reputation, message content, and organizational policy.
How to analyze Outlook security headers efficiently
Manual reading works for a single email, but repeat investigations are faster with a structured approach.
Start by copying the complete header block, then review the authentication status and mail path before checking Microsoft-specific fields.
A practical workflow looks like this:
- Copy the full headers from Outlook.
- Check Authentication-Results for SPF, DKIM, and DMARC.
- Review Received headers from bottom to top.
- Compare From, Reply-To, and Return-Path.
- Look for Microsoft transport or spam-filtering markers.
- Correlate suspicious IDs with Exchange or security logs if available.
For larger environments, you can also use Microsoft 365 Defender, Exchange Online message trace, or third-party email security platforms to validate what the headers show.
These tools are especially helpful when users forward screenshots instead of the full raw message.
When should you escalate the findings?
If the headers show authentication failures, unexpected infrastructure, or evidence of spoofing, escalate to your security or messaging team.
The same is true if the message claims to come from a high-risk sender such as finance, HR, Microsoft, or a cloud provider.
Escalation is also appropriate when:
- A user entered credentials after clicking a link
- The message requested a wire transfer or gift cards
- The email impersonated an executive or vendor
- The headers do not match the organization’s normal email path
Preserve the original email, including full headers, before deleting or quarantining it.
That evidence is often needed for incident response, abuse reporting, and mail gateway tuning.
Tips for reliable header review
Header analysis is only useful if you preserve the original data and interpret it in context.
Keep these practices in mind:
- Always inspect the full raw headers, not just the visible message preview.
- Use the complete header block, because copied fragments can omit key evidence.
- Cross-check authentication results with your domain’s DNS records.
- Remember that forwarded or mailing-list messages can alter SPF outcomes.
- Document suspicious values before making any changes to the mailbox or message.
Understanding how to check Outlook security headers gives you a clearer view of sender trust, message routing, and policy enforcement.
In Microsoft 365 environments, those details often determine whether an email is safe, suspicious, or worth investigating further.