Written by Jennifer Walsh. Reviewed for technical accuracy by Shubham Dixit, Independent Expert in Email Forensics and Data File Conversion. Updated 18 September 2026.
Shubham is an independent external reviewer and not an employee of PCDOTS.
Quick answer. An MBOX file is plain text, so every email’s headers sit right at the top, above a blank line and the body. To view them for free, open the .mbox in a text editor, read a header with a short Python script or press Ctrl+U in Thunderbird. A free MBOX viewer shows the headers in a window. The headers reveal the real sender, the routing and the SPF and DKIM checks.
On this page
Why can you read MBOX headers without a tool?
An MBOX file is plain text. It stores every email one after another, and every one is a header block, then a blank line, then the body. That’s the standard email layout, set out in RFC 5322.
So the headers sit right at the top of every message, in readable text. You don’t need a paid tool to see them. Open the .mbox and the From, Received and authentication lines are there to read.
This is why viewing headers is really just reading the MBOX. The free routes below open the file three ways, then a section explains what the headers mean.
Every MBOX message is headers, a blank line, then the body, all plain text.
“In a case, the headers are where the truth is. An MBOX is plain text, so I don’t reach for software first, I open it and read. The From line is what the sender claims, but the Received lines are the real trail, and they run newest at the top, so you read them bottom up to find the origin server and its IP. Then I check Authentication-Results, if SPF, DKIM or DMARC say fail, that’s a spoofing flag. A viewer makes it tidier for a big file, but a text editor already shows you everything that matters.” Shubham Dixit, Email Forensics reviewer (draft, pending approval)
How do you view MBOX email headers for free?
You view MBOX email headers for free in three ways, a text editor, a short Python script or Thunderbird. All read the plain text, so no paid tool is needed.
Here are the steps for every route.
- Text editor. Open the .mbox in Notepad or VS Code. Every message starts with a From line, then the header block down to the first blank line.
- Python. Read one header across all messages with
import mailbox; [print(m['Received']) for m in mailbox.mbox('file.mbox')]. - Thunderbird. Import the MBOX, open a message, then press Ctrl+U for View Message Source, which shows the full raw headers.
- For a big file, a free MBOX viewer lists the messages and shows the Message Header per email, covered below.
For a quick check I just open the file in a text editor, since the headers are the first thing in every message. Python is my choice when I need the same header, like Message-ID, pulled from hundreds of emails at once. On a Mac or Linux, grep -i "^Received:" file.mbox lists every routing line straight from the plain text.
A text editor, Python or Thunderbird, all read the same plain-text headers.
What do the headers tell you?
The headers are more than From and Subject. They carry the routing and the checks that show whether an email is real. Here’s what to read.
The headers that matter
- From and Return-Path. What the sender claims. A mismatch between the two is worth a second look.
- Received. One line per server hop. The raw list runs newest first, so read from the bottom up. The bottom line holds the origin server and its IP.
- Authentication-Results. The SPF, DKIM and DMARC verdicts. A fail on any of them is a spoofing flag.
- Message-ID and Date. A unique id from the sending server, and the time it was sent.
- X-headers. Extra lines a server can add, like X-Spam-Status or X-Spam-Score from a spam filter, and X-Mailer for the sending app.
Here’s a trimmed example of what to look for.
From: Support <[email protected]>
Return-Path: <[email protected]>
Received: from mx.google.com by inbox.example.net ...
Received: from smtp.example.com (203.0.113.7) by mx.google.com ...
Authentication-Results: mx.google.com;
spf=pass dkim=pass dmarc=pass header.from=example.com
Message-ID: <[email protected]>Two quick checks. Compare the From domain with the DKIM signing domain (the d= value), since a mismatch is a common spoofing sign. And if you’d like a parsed, hop-by-hop view, an online analyzer helps, but headers hold internal server names and IPs, so don’t paste confidential mail into an unknown site.
How do you view headers in a free MBOX viewer?
You view headers in a free MBOX viewer when you’d rather have a window than a text editor, or the file is large. It lists the messages and shows the header for the one you select.
PCDOTS MBOX File Viewer opens a MBOX free, lists every message and has a Message Header option that shows the full header block. It runs on Windows and reads MBOX from any client. The pro edition also exports messages to PDF for a case file. Follow these four steps.
- Install and run the viewer, then click Open.
- Choose MBOX Files, then select your files or a folder.
- Select a message from the list to preview it.
- Open the Message Header view to read the full headers.
The viewer route, the Message Header shown for the email you select.
Here are the four steps with the screens.
Step 1. Run the viewer and click Open.
Step 2. Choose MBOX Files and select your files.
Step 3. Select a message to preview.
Step 4. Open the Message Header view.
Related reading, our guides to extract email addresses from an MBOX file and export Outlook to MBOX. For a case, our email forensics page goes deeper on headers.
Servers add their line at the top, so the oldest hop, the origin, sits at the bottom.
Which method should you use?
Use a text editor for a quick look, Python for many messages and a viewer for a friendly window.
| Method | Best for | Good to know |
|---|---|---|
| Text editor | A quick look | Free, headers at the top of every message |
| Python mailbox | Many messages | Free, pull one header from all |
| Free MBOX viewer | A friendly window | Windows, Message Header view |
Key takeaways
- An MBOX is plain text, so the headers sit at the top of every message and open in any editor.
- Read them free with a text editor, a short Python script or Ctrl+U in Thunderbird.
- Received lines run newest first, so read bottom to top to find the origin server.
- Authentication-Results shows the SPF, DKIM and DMARC verdicts, and a fail is a spoofing flag.
Frequently asked questions
Can I view MBOX headers without any software?
Yes. An MBOX is plain text, so a text editor like Notepad shows the header block at the top of every message. No email client or paid tool is needed.
How do I read the full headers in Thunderbird?
Open the message, then press Ctrl+U for View Message Source. That shows the complete raw email, every header and the body, in one window.
How do I read the Received path?
Every server adds a Received line at the top, so the raw list runs newest first. Read from the bottom up. The bottom line shows the origin server and its IP.
How do I check if an email is spoofed?
Read the Authentication-Results header. It lists the SPF, DKIM and DMARC verdicts, and a fail on any of them is a warning sign for a fake sender.
How do I pull one header from every message?
Use Python’s mailbox module in a loop, printing the header you want, like Received or Message-ID, for every message in the file.
Can I read MBOX headers on a Mac?
Yes. Open the .mbox in TextEdit or another editor, or use Python, since the plain-text format is the same on a Mac. The PCDOTS viewer is Windows only.
So what are the headers telling you?
Viewing MBOX headers is free, because the file is plain text and the headers are the first thing in every message. Open it in a text editor, pull a header with Python or press Ctrl+U in Thunderbird, and a free viewer tidies it into a window. Once you can see them, the From line is the claim, the Received path is the trail and the SPF and DKIM verdicts are the proof. So what are the headers telling you, a real sender, or a spoofed one?
