OSXFAQ Mac OS X Tip-of-the-Day  

When you view an email, Mail.app presents you with a pretty header showing a shortened where's and who's. This email came from PayPal...

... or did it.

To view the full header details, select menu item "View: Message: Long Headers". You'll see more detail, including the revealing envelope information 'Recevied: '. The rest can be easily faked.

The example above shows no proper hostnames in the 'Received:' lines. A genuine email from PayPal would have a 'Received:' line like this:

The part in parenthesis shows the [IP address] from which the email originated, and the hostname associated with that IP address.

This should correspond to what you see with a DNS lookup:

Selecting menu item 'View : Message: Raw Source' also reveals the raw message text, which is useful to check links. For example, an email may display like:

"In order to secure your account we may require some specific information from you.
We encourage you to log in by clicking on the link below and complete the requested
form as soon as possible. 

https://www.paypal.com/cgi-bin/webscr?cmd=_login-run"

But the raw source reveals that the link points elsewhere"

"In order to secure your account we may require some specific information f=
rom you.
We encourage you to log in by clicking on the link below and complete the =
requested form as soon as possible.
<br><br><br><a href=3D"http://ns11.hiwit.net/~richard/"
  ...

The spam came from (a) Dick.

Note that where PayPal is concerned, one would never click a link anywhere, but type the PayPal URL into Safari or use a manually created bookmark.

Enjoy! :- )

Tiger 10.4.3