How can I view a header to determine an email's path or origin?
E-mail Inbound, Outbound, Outreach, Marketing
To determine the origin of an email and how it may be entering or leaving your Oracle Service Cloud site, it is useful to view the email header. Headers are contained in the console in an attached the .msg file, email header, or in your email client such as Gmail. Email headers determine where a message is sent, and records the specific path the message follows as it passes through each mail server. To follow the path of a message chronologically, read from the bottom of the header, and work your way up.
In order to have email headers included within emails on your site, you will need to make sure that the configuration setting EGW_SAVE_EMAIL_HEADERS or EGW_SAVE_ORIG_MESSAGE is set to "yes."
Path to setting(s): Select Configuration from the navigation area > Site Configuration > Configuration Settings > and search by Key.For more information on accessing the Configuration Editor and editing settings, refer to Answer ID 1960: Editing Configuration Settings.
To view a header within your site, if the source of an incident is email, you will see an envelope icon beside the Contact's name in the blue title bar of the discussion thread.
Once EGW_SAVE_EMAIL_HEADERS is enabled, it is also possible to create a custom report to view header information. Note, the header information is stored in the threads table which is commonly joined to the incidents table in reports. Due to the size of these tables, it is recommended to limit the amount of data being pulled by reference number or date range. To view the header information within a report, include the Mail Header (mail_hdr) field from the threads table as an output column. With the 'save header' setting enabled, for incidents created from email, the email header information will be returned.
For more information on creating a custom report, refer to Answer ID 2509: Creating a basic custom report.
You can also view headers for outgoing email in most mail clients. Refer to Answer ID 4781: Collecting email headers or source for Oracle Service Cloud Technical Support for more information.
A sample email header is provided below. For example purposes, the server and email information have been generalized such as "email@example.com". The header has also been truncated to make it easier to read. In the example below, the Received lines are the most useful. From the top, they represent the receipt on the e-mail servers that handled this e-mail from most recent to least recent. The top Received line is usually the machine that actually performed final delivery of email. One indication that the headers may have been falsified (commonly known as spoofed message) is if the "by hostname.domain" portion does not match the "from hostname.domain" portion within the Received line.
Received: from mailserver1.mysite.com (mailserver1.mysite.com [server's IP Address])
by mailserver1l.mysite.com ...
Sat, 13 Mar 2018 09:29:14 -0500
Received: from mailserver.domain.com (mailserver.domain.com [server's IP Address])
by mailserver1.mysite.com ...
Sat, 13 Mar 2018 09:28:53 -0500
Received: from www.domain.com (server's IP Address)
by mail11b.verio-web.com (RS ver 1.0.91vs) ...
Sat, 13 Mar 2018 09:28:49 -0500 (EST)
Received: (from account@localhost)
by domain.com (8.12.9/8.12.9/Submit) ...
Sat, 13 Mar 2018 09:28:12 -0500 (EST)
Date: Sat, 13 Mar 2018 09:28:12 -0500 (EST)
Content-Type: multipart/alternative; boundary=9RDKHg9Ub15H7
Subject: Your chance to get in on the bottom of an amazing company ...
What scenarios might warrant such header investigation?
- To verify server path of outgoing messages
- An Outreach email sent to your customer multiple times
- An email (Service or Outreach) was sent to your customer but you do not believe that it was sent at all or at the time the customer indicates. Example: You sent an Outreach email announcing an online event happening over the weekend but the customer received the mailing on Monday.
- Email received by customer appears to be spam but was sent from Oracle Service Cloud
- A report that an email sent from your customer was delayed in getting processed into an incident.
- If you host your own mailbox which sends emails into Oracle Service Cloud then it is useful to view the email header for the .msg file. In this scenario it is also useful for your mail administrator to examine the SMTP transactions for further information.
If you have further questions or need details regarding interpretation of email headers, consult your organization's internal mail/network administration team. If you require assistance in troubleshooting an issue related to this, please submit an incident to Technical Support through Ask Technical Support. Be sure to attach example .msg files.