Most email programs do not normally show a message's full email headers by default. The method for displaying full email headers depends on the program you're using. The SpamCop FAQ has good program-specific instructions. When displayed, a typical message's full headers look something like this:
Return-Path: <myfriend@email.unc.edu>
Received: from poserver.mail.duke.edu (localhost [127.0.0.1])
by poserver.mail.duke.edu (Cyrus v2.0.17); Tue, 01 Apr 2003 14:06:41
-050X-Sieve: cmu-sieve 2.0
Received: from incoming.mail.duke.edu (incoming.mail.duke.edu [152.3.xxx.x])
by poserver.mail.duke.edu (8.12.9/8.12.9/Duke-5.0.0) with ESMTP id
h31J6fof016433
for <frobob@poserver.mail.duke.edu>; Tue, 1 Apr 2003 14:06:41 -0500
(ESTReceived: from smtp.unc.edu (outgoing.mail.unc.edu [152.2.yyy.y])
by incoming.mail.duke.edu (8.12.9/8.12.9/Duke-5.0.0) with ESMTP id
h31J6UiQ020290
for <frobob@duke.edu>; Tue, 1 Apr 2003 14:06:31 -0500 (EST)
Received: from email.unc.edu (workstation.dept.unc.edu [152.2.zzz.z])
(authenticated bits=0)
by smtp.unc.edu (8.12.2/8.12.2) with ESMTP id h31J5l4H009239;
Tue, 1 Apr 2003 14:05:47 -0500 (EST)
Message-ID: <3E89E30B.11C51DB@email.unc.edu>
Date: Tue, 01 Apr 2003 14:05:47 -0500
From: My Friend <myfriend@email.unc.edu>
X-Mailer: Mozilla 4.78 [en] (Windows NT 5.0; U)
MIME-Version: 1.0
To: "Sly O. Frobobnowitz" <frobob@duke.edu>
Subject: Meeting on Friday
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-milter, Duke University (http://amavis.org/)