Share

Retrieve Outlook's Internet Headers

Retrieving the Internet or Full Header information from an email will help Ag IT Support troubleshoot issues in mail delivery.
  1. Outlook 2010 or Outlook 2013 or  Outlook 2016:
    Open the message. Click the File tab and click the Properties button.
  2. In this new window, the full header information is in the box labeled Internet headers.
  3. Click in the Internet headers field. Press Ctrl + A to select the text.
  4. Press Ctrl + C to copy the text.
  5. Click Close.
  6. Click Forward.
  7. Press Ctrl + V to paste the header text into this email.
  8. If you've been requested to send this to Computer Support, enter AgCompSupport@psu.edu in the "To:" field and click Send.

Sample Internet Headers

Note: On 7/12/2010 Barracuda SPAM filtering service was installed on CAS IT's Exchange server. The Barracuda Networks device tests each message that is delivered to the College's Exchange server from the 'outside' world. This includes other Penn State email servers and the Internet. The "X-Barracuda-Spam-Status" will list the score for each email.  Messages are given a score from 0 to 10. These levels will be adjusted over time as the system 'learns' what Spam messages are delivered to our Exchange server.

When you review the "X-Barracuda-Spam-Status" line, you will see the various LEVELS (Tag, Quarantine, Kill)  in place at that time. Here is a set of example number levels. These example levels are used in the following sample email headers.

X-Barracuda-Spam-Status: No, SCORE=1.93 using global scores of TAG_LEVEL=3.5 QUARANTINE_LEVEL=4.5 KILL_LEVEL=6.0 tests=[you see a number of tests run by Barracuda. These will change dependent on the message content]. The score of the individual tests will total up to the overall score (samples below).

0.0 - 3.49 --> Delivered to Inbox.
3.5 - 4.49 --> Delivered to Inbox. Subject line tagged with [Suspected Spam]. (TAG_LEVEL=3.5)
4.5 - 5.99 --> Delivered to Barracuda Quarantine Inbox.   (QUARANTINE_LEVEL=4.5)
6.0 - 10.0 --> Blocked from delivery.   (KILL_LEVEL=6.0)

Note: Messages sent 'internally' within Exchange will not have the X-Barracuda-Spam-Score lines.


SAFE HEADER EXAMPLE - EMAIL BETWEEN EXCHANGE ACCOUNTS

Received: from AGEXMB1.AG.PSU.EDU ([169.254.1.97]) by AGEXCASHUB2.AG.PSU.EDU
 ([fe80::5120:8853:5404:2b33%12]) with mapi; Mon, 12 Jul 2010 17:42:17 -0400
Content-Type: application/ms-tnef; name="winmail.dat"
Content-Transfer-Encoding: binary
From: [removed]
To: Vince Verbeke <vcv1@psu.edu>
Subject: Re: [removed]
Thread-Topic: [removed]
Thread-Index: AQHLHtyiT+QZfM8LhEKhQhDUrkzdiJKtwDsQgABbO4A=
Date: Mon, 12 Jul 2010 17:42:03 -0400
Message-ID: <9A2EDCB4-A69E-44C0-8772-864E2905040B@psu.edu>
References: <647976.79979.qm@web52101.mail.re2.yahoo.com>
 <B4C0D235-56A4-44A0-923C-90BF0426F630@psu.edu>
 <BA11DEE8A622074F896BC3EEA04CEA5F057004C7@AGEXMB1.AG.PSU.EDU>
In-Reply-To: <BA11DEE8A622074F896BC3EEA04CEA5F057004C7@AGEXMB1.AG.PSU.EDU>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-Exchange-Organization-SCL: -1
X-MS-TNEF-Correlator: <9A2EDCB4-A69E-44C0-8772-864E2905040B@psu.edu>
MIME-Version: 1.0
X-MS-Exchange-Organization-AuthSource: AGEXCASHUB2.AG.PSU.EDU
X-MS-Exchange-Organization-AuthAs: Internal
X-MS-Exchange-Organization-AuthMechanism: 04


SAFE HEADER EXAMPLE - EMAIL TO COLLEGE LIST

Received: from Barracuda1.ag.psu.edu (128.118.124.216) by
AGEXCASHUB2.AG.PSU.EDU (128.118.124.218) with Microsoft SMTP Server id
14.0.702.0; Tue, 13 Jul 2010 09:13:51 -0400
X-ASG-Debug-ID: 1279026829-457b16ba0001-IHxC7Z
Received: from gsmail.cas.psu.edu ([128.118.82.41]) by Barracuda1.ag.psu.edu
with ESMTP id lBDha2gn3aUBzG1o for <itgroup@ag.psu.edu>; Tue, 13 Jul 2010
09:13:49 -0400 (EDT)
X-Barracuda-Envelope-From: bounce-adminnoticesup-351117@lists.cas.psu.edu
X-ASG-Whitelist: Sender
X-Barracuda-Apparent-Source-IP: 128.118.82.41
Received: from lists.cas.psu.edu (lists.cas.psu.edu [128.118.93.34])    by
gsmail.cas.psu.edu (Postfix) with SMTP id B146C8E2A0    for
<itgroup@ag.psu.edu>; Tue, 13 Jul 2010 09:17:24 -0400 (EDT)
X-JSpamFilter-Version: 3.8 Enterprise (Penn State U. - Coll. of Ag Sci. (Unlimited Edu. Ent.)) (Score: 27, 16ms)
X-Barracuda-BBL-IP: 128.118.93.34
X-Barracuda-RBL-IP: 128.118.93.34
From: [removed]
To: [removed]
Subject: COMING UP! on Reframing Roundtables & Training
Thread-Topic: COMING UP! on Reframing Roundtables & Training
X-ASG-Orig-Subj: COMING UP! on Reframing Roundtables & Training
Thread-Index: AQHLIo0ilL8aMFOD3k6DuVANU6U8lQ==
Date: Tue, 13 Jul 2010 13:13:07 +0000
Message-ID: <LYRIS-351117-7712758-2010.07.13-09.13.28--itgroup#ag.psu.edu@lists.cas.psu.edu>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Content-Type: multipart/related;
    boundary="_004_263C9AD46E2FAC40A0E94972FD4A3AFC139DF524AGEXMB1AGPSUEDU_";
    type="multipart/alternative"
MIME-Version: 1.0
X-Virus-Scanned: by amavisd-new
X-Barracuda-Connect: UNKNOWN[128.118.82.41]
X-Barracuda-Start-Time: 1279026829
X-Barracuda-URL: http://Quarantine.ag.psu.edu:8000/cgi-mod/mark.cgi
X-Virus-Scanned: by bsmtpd at ag.psu.edu
Return-Path: bounce-[removed]-351117@lists.cas.psu.edu
X-MS-Exchange-Organization-AuthSource: AGEXCASHUB2.AG.PSU.EDU
X-MS-Exchange-Organization-AuthAs: Anonymous
X-Auto-Response-Suppress: DR, OOF, AutoReply


SAFE HEADER EXAMPLE FROM OUTSIDE SOURCE

Note: This email will be delivered to Inbox.

Note: Since these messages comes from an "outside source' they will pass through Penn State's email servers to reach the College's Exchange server. Penn State tests messages that arrives through its email servers using a product called SpamAssassin. SpamAssassin inserts two tags into the header of each email that it filters. One is called "X-PSU-Spam-Hits number" and the other is "X-PSU-Spam-Flag". If this Spam-Hits number is higher than 3.000, the "X-PSU-Spam-Flag" tag is set to Yes. This flag is not used by Barracuda.

Received: from Barracuda2.ag.psu.edu (128.118.124.217) by
 AGEXCASHUB2.AG.PSU.EDU (128.118.124.218) with Microsoft SMTP Server id
 14.0.702.0; Thu, 15 Jul 2010 00:04:26 -0400
X-ASG-Debug-ID: 1279166663-5681021d0001-rRZe35
Received: from tr10n04.aset.psu.edu ([128.118.142.105]) by
 Barracuda2.ag.psu.edu with ESMTP id 404YOADISc982HPu for <vcv1@ag.psu.edu>;
 Thu, 15 Jul 2010 00:04:23 -0400 (EDT)
X-Barracuda-Envelope-From: do_not_reply@win7news.net
X-Barracuda-Apparent-Source-IP: 128.118.142.105
Received: from thor.sunbelt-software.com (thor.sunbelt-software.com
 [64.128.133.145])    by tr10n04.aset.psu.edu (8.13.6/8.13.2) with ESMTP id
 o6F44Kn61626154    for <keeper@psu.edu>; Thu, 15 Jul 2010 00:04:21 -0400
Received: from mail pickup service by thor.sunbelt-software.com with Microsoft
 SMTPSVC;     Thu, 15 Jul 2010 00:07:28 -0400
X-Barracuda-BBL-IP: 64.128.133.145
X-Barracuda-RBL-IP: 64.128.133.145
From: Win7News <do_not_reply@win7news.net>
To: <keeper@psu.edu>
Subject: The Wave Keeps Coming: Windows Live Essentials Review, Continued
Content-Transfer-Encoding: 8BIT
X-ASG-Orig-Subj: The Wave Keeps Coming: Windows Live Essentials Review, Continued
Content-Type: text/html; charset="iso-8859-1"
Reply-To: <do_not_reply@win7news.net>
Message-ID: <THORJZ0z7MeFgDTOCOg001dfb09@thor.sunbelt-software.com>
X-OriginalArrivalTime: 15 Jul 2010 04:07:28.0033 (UTC) FILETIME=[3D194910:01CB23D3]
Date: Thu, 15 Jul 2010 00:07:28 -0400
X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-3.1.8 (tr10n04.aset.psu.edu [128.118.142.105]); Thu, 15 Jul 2010 00:04:21 -0400 (EDT)
X-Virus-Scanned: amavisd-sophos
X-PSU-Spam-Flag: No
Precedence: bulk
X-PSU-Spam-Hits: 1.7
X-PSU-Spam-Level: **
X-Barracuda-Connect: UNKNOWN[128.118.142.105]
X-Barracuda-Start-Time: 1279166663
X-Barracuda-URL: http://128.118.124.217:8000/cgi-mod/mark.cgi
X-Virus-Scanned: by bsmtpd at ag.psu.edu
X-Barracuda-Spam-Score: 1.93
X-Barracuda-Spam-Status: No, SCORE=1.93 using global scores of TAG_LEVEL=3.5 QUARANTINE_LEVEL=4.5 KILL_LEVEL=6.0 tests=BAD_CREDIT, BSF_SC0_SA275b_HL, BSF_SC5_MJ1963, HTML_MESSAGE, MIME_HTML_ONLY, RDNS_NONE
X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.35234
    Rule breakdown below
     pts rule name              description
    ---- ---------------------- --------------------------------------------------
    0.33 BAD_CREDIT             BODY: Eliminate Bad Credit
    0.00 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
    0.00 HTML_MESSAGE           BODY: HTML included in message
    0.10 RDNS_NONE              Delivered to trusted network by a host with no rDNS
    0.50 BSF_SC5_MJ1963         Custom Rule MJ1963
    1.00 BSF_SC0_SA275b_HL      Custom Rule SA275b_HL
MIME-Version: 1.0
Return-Path: do_not_reply@win7news.net
X-MS-Exchange-Organization-AuthSource: AGEXCASHUB2.AG.PSU.EDU
X-MS-Exchange-Organization-AuthAs: Anonymous


[SUSPECTED SPAM] HEADER EXAMPLE FROM OUTSIDE SOURCE

Note: This email will be delivered to Inbox and the Subject line tagged with [Suspected Spam].

Note: As of 10/22/2010,  Penn State’s Spam filter determines the message is Spam, the Barracuda Spam Filtering Service will mark the email with the [Suspected Spam] header as well.

Received: from Barracuda1.ag.psu.edu (128.118.124.216) by
 AGEXCASHUB2.AG.PSU.EDU (128.118.124.218) with Microsoft SMTP Server id
 14.0.702.0; Tue, 13 Jul 2010 16:52:31 -0400
X-ASG-Debug-ID: 1279054350-457b40020001-s3zWNw
Received: from tr12n05.aset.psu.edu ([128.118.146.135]) by
 Barracuda1.ag.psu.edu with ESMTP id 0RZC4kmwsFm6NyIX for
 <agcompsupport@ag.psu.edu>; Tue, 13 Jul 2010 16:52:30 -0400 (EDT)
X-Barracuda-Envelope-From: [removed]
X-Barracuda-Apparent-Source-IP: 128.118.146.135
Received: from [removed] ([removed][[removed]])    by
 tr12n05.aset.psu.edu (8.13.6/8.13.2) with SMTP id o6DKqRhk3608600    for
 <AgCompSupport@psu.edu>; Tue, 13 Jul 2010 16:52:28 -0400
X-EYOU-SPAMVALUE: 0
X-Barracuda-BBL-IP: 60.190.248.194
X-Barracuda-RBL-IP: 60.190.248.194
X-EYOU-DEALDRC:
X-EMDG-VER: 2009-11-28
Received: (eyou anti_spam gateway 3.0); Wed, 14 Jul 2010 04:38:23 +0800
Message-ID: <479053503.21463@[removed]>
X-EYOUMAIL-SMTPAUTH: @
Received: from 124.90.128.42 by 60.190.248.194 with SMTP; Wed, 14 Jul 2010
 04:38:23 +0800
From: =?GB2312?B?tdrKrrb+vezO97r+ufq8ytbQ0KHG89K10dDM1rvh1+nOr7vh?=
    [removed]
Subject: [Suspected Spam]  Invitation letter from WLICSMB2010
To: <AgComm@auburn.edu>
X-ASG-Orig-Subj: Invitation letter from WLICSMB2010
Content-Type: text/html
Reply-To: [removed]
Date: Wed, 14 Jul 2010 04:52:26 +0800
X-Library: Indy 9.00.10
X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-3.1.8 (tr12n05.aset.psu.edu [128.118.146.135]); Tue, 13 Jul 2010 16:52:30 -0400 (EDT)
X-Virus-Scanned: amavisd-sophos
X-PSU-Spam-Flag: YES
Precedence: bulk
X-PSU-Spam-Hits: 6.999
X-PSU-Spam-Level: *******
X-Barracuda-Connect: UNKNOWN[128.118.146.135]
X-Barracuda-Start-Time: 1279054350
X-Barracuda-URL: http://Quarantine.ag.psu.edu:8000/cgi-mod/mark.cgi
X-Virus-Scanned: by bsmtpd at ag.psu.edu
X-Barracuda-Spam-Score: 4.01
X-Barracuda-Spam-Status: Yes, SCORE=4.01 using global scores of TAG_LEVEL=3.5 QUARANTINE_LEVEL=4.5 KILL_LEVEL=6.0 tests=BSF_SC5_MJ1963, HTML_MESSAGE, HTML_MIME_NO_HTML_TAG, MIME_HEADER_CTYPE_ONLY, MIME_HTML_ONLY, MSGID_FROM_MTA_HEADER, MSGID_FROM_MTA_HEADER_2, RCVD_DOUBLE_IP_LOOSE, RDNS_NONE
X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.35118
    Rule breakdown below
     pts rule name              description
    ---- ---------------------- --------------------------------------------------
    0.00 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
    0.00 HTML_MESSAGE           BODY: HTML included in message
    1.05 HTML_MIME_NO_HTML_TAG  HTML-only message, but there is no HTML tag
    0.86 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME
                               headers
    0.10 RDNS_NONE              Delivered to trusted network by a host with no rDNS
    0.00 MSGID_FROM_MTA_HEADER  Message-Id was added by a relay
    0.00 RCVD_DOUBLE_IP_LOOSE   Received: by and from look like IP addresses
    0.50 BSF_SC5_MJ1963         Custom Rule MJ1963
    1.50 MSGID_FROM_MTA_HEADER_2 Message-Id was added by a relay
X-Priority: 5 (Lowest)
X-MSMail-Priority: Low
Importance: Low
X-Barracuda-Spam-Flag: YES
MIME-Version: 1.0
Return-Path: [removed]
X-MS-Exchange-Organization-AuthSource: AGEXCASHUB2.AG.PSU.EDU
X-MS-Exchange-Organization-AuthAs: Anonymous


QUARANTINED HEADER EXAMPLE FROM OUTSIDE SOURCE

Note: This message will be delivered to your Barracuda Quarantine Inbox.

 X-ASG-Debug-ID: 1279178878-568105900001-s3zWNw
Received: from tr12n04.aset.psu.edu ([128.118.146.130]) by Barracuda2.ag.psu.edu with ESMTP id UzfRSE9izUqaSAWs; Thu, 15 Jul 2010 03:27:58 -0400 (EDT)
X-Barracuda-Envelope-From: [removed]
X-Barracuda-Apparent-Source-IP: 128.118.146.130
Received: from  [removed] ( [removed] [ [removed]])
    by tr12n04.aset.psu.edu (8.13.6/8.13.2) with ESMTP id o6F7RuPT3440840;
    Thu, 15 Jul 2010 03:27:56 -0400
Received: from  [removed] (127.0.0.1 [127.0.0.1])
        by  [removed] (IceWarp 10.0.4) with ASMTP id XOL06224;
        Thu, 15 Jul 2010 09:22:24 +0200
X-Barracuda-BBL-IP: 194.255.6.10
X-Barracuda-RBL-IP: 194.255.6.10
Date: Thu, 15 Jul 2010 09:22:23 +0200
From: [removed]
Subject: E-ticket number: 890231AN-333
Message-ID: <1f45b5f37be51068b5cb244da8aade33@ [removed]>
X-ASG-Orig-Subj: E-ticket number: 890231AN-333
X-Mailer: IceWarp Mailer 10.0.4
X-Priority: 3
Reply-To: mr.leonbecker06@[removed]
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=UTF-8
X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-3.1.8 (tr12n04.aset.psu.edu [128.118.146.130]); Thu, 15 Jul 2010 03:27:57 -0400 (EDT)
X-Virus-Scanned: amavisd-sophos
X-PSU-Spam-Flag: YES
Precedence: bulk
X-PSU-Spam-Hits: 4.336
X-PSU-Spam-Level: ****
X-Barracuda-Connect: UNKNOWN[128.118.146.130]
X-Barracuda-Start-Time: 1279178878
X-Barracuda-URL: http://128.118.124.217:8000/cgi-mod/mark.cgi
X-Barracuda-Orig-Rcpt: agcompsupport@ag.psu.edu
X-Virus-Scanned: by bsmtpd at ag.psu.edu
X-ASG-Quarantine: Fingerprint *Phishing.Lottery.Scams-13938050
X-Barracuda-Fingerprint-Found: *Phishing.Lottery.Scams-13938050 (89e157b5fdafc4fbee604f20d15ff93d-821-txt)
X-Barracuda-Envelope-From: [removed]
X-Barracuda-Quarantine-Per-User: PER_USER
X-Barracuda-Spam-Score: 4.58
X-Barracuda-Spam-Status: Yes, SCORE=4.58
using global scores of TAG_LEVEL=3.5 QUARANTINE_LEVEL=4.5 KILL_LEVEL=6.0 tests=KAM_LOTTO1, MISSING_HEADERS, RDNS_NONE, TO_CC_NONE
X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.35241
    Rule breakdown below
     pts rule name              description
    ---- ---------------------- --------------------------------------------------
    1.58  MISSING_HEADERS        Missing To: header    
    0.00  TO_CC_NONE             No To: or Cc: header    
    0.10  RDNS_NONE              Delivered to trusted network by a host with no rDNS    
    2.90  KAM_LOTTO1             Likely to be a e-Lotto Scam Email