Summary of what a forwarded email looks like
A forwarded email typically includes the original message embedded within a new email body, often marked by > quote prefixes, a separator line, and metadata such as the originating sender, date, and subject. In email clients, forwarded messages may show an attached or inline message preview, additional headers, and indicators like “Forwarded” or “FW:” in the subject. Visually, the original text appears after the forward body and may be styled as plain text or rich HTML depending on the client and user settings.
How forwarding works in common email clients
Email clients handle forwarding by creating a new message that bundles the original content with a new header and body context. The original message may be attached as an .eml, embedded inline, or presented as a quoted block. Popular clients including Gmail, Outlook, Apple Mail, and Thunderbird each apply their own layout and default text to indicate the forwarded origin, and may include an attachment icon or inline message card.
Gmail forwarding appearance
In Gmail, forwarding produces a new compose window with the original message collapsed under a “Original message” section. The subject gains “Fwd:” or “Forwarded”, and recipients see the sender, timestamp, and original subject in a summary bar. The forwarded body appears above the original, and attachments are carried over as downloadable files.
Outlook and Microsoft 365 forwarding appearance
Outlook typically inserts a brief note such as “------ Forwarded message —” before presenting the original content, which may render as rich text or HTML. An attached message icon or inline card may represent the original, with visible fields like From, Sent, To, and Subject, and the subject line prefixed with “FW:” or “Fwd:”.
Apple Mail and Thunderbird forwarding appearance
Apple Mail inserts “On [date], [sender] wrote:” lines and preserves indentation or > quote markers; attachments are included as separate files. Thunderbird shows similar cues and may include additional headers or an inline message preview, making the forwarding chain visually traceable.
Identifying a forwarded email reliably
To determine whether an email is a forward, examine the message headers for original sender and date fields, check for forwarded indicators in the subject line, and look for visual cues such as separator lines, quote blocks, or attached message previews. Headers and client-specific UI elements provide consistent signals that are useful across email platforms.
Header fields and technical indicators
Email headers expose the path and handling of a forwarded message. Key headers include Received, Message-ID, In-Reply-To, and References, which may link the new message to the original. While X-Originating-IP and ARC-Authentication-Results can help verify source infrastructure, the presence of References and Message-ID is a stronger indicator of a forwarded or retransmitted email.
Typical header chain when an email is forwarded
When an email is forwarded, the new message includes its own Message-ID, while the References header often preserves the original Message-ID, creating a traceable chain. This linkage, combined with Received timestamps, supports reliable identification of forwarded content without relying solely on subject patterns or visible formatting.
| Header attribute | Verified detail | Source type |
|---|---|---|
| Message-ID | Unique per message instance; new ID on forward | Email standard |
| References | Often includes original Message-ID to indicate continuation | Email standard |
| In-Reply-To | May mirror References when threading replies and forwards | Email standard |
| Received | Shows hops and timestamps for chain-of-custody | Email standard |
| Subject | Prefix such as “FW:” or “Fwd:” commonly added | Client convention |
| X-Originating-IP | May expose sending IP when included by relays | Optional/relay-added |
Formatting and presentation differences
Forwarded messages can appear as plain text with > quote prefixes, structured HTML with embedded blocks, or attached .eml files that preserve full headers and MIME structure. Clients differ in how much of the original formatting they retain, and users can choose to trim attachments or rewrite parts of the body before sending.
Best practices for identifying and handling forwards
- Check the subject for common forward prefixes such as “FW:” or “Fwd:”.
- Inspect message headers for References and Message-ID linkage to the suspected original.
- Look for visual cues like separator lines (“------ Forwarded message —”) and quoted blocks prefixed with >.
- Review the timestamp and sender fields in the email client to confirm continuity.
- When in doubt, download and view the original .eml attachment to see complete headers and structure.
Common misconceptions about forwarded emails
Not all emails with a forward prefix or similar subject are necessarily forwarded; replies and meeting forwards may resemble forwards. Similarly, edits to the body or removal of attachments do not change the technical identity of a forwarded message. Rely on header linkage and client metadata for a dependable determination rather than appearance alone.
Privacy and handling considerations
Forwarding can expose additional recipient data and alter perceived provenance, so consider privacy and chain-of-custody when redistributing forwarded content. Headers may reveal IP addresses and internal hostnames, so redaction or careful review is advised when sharing forwarded messages externally.
Extending your analysis across clients
Patterns described here apply broadly, but rendering can vary by client version and user configuration. When building tooling or policies, test against the major email platforms you support and account for optional features such as inline previews, client-specific indicators, and attachment handling preferences.
When a forwarded email may indicate risk
Unexpected header chains, mismatched timestamps, or discrepancies between sender claims and header hops can signal issues such as spoofing, mailing list errors, or unauthorized relay. For investigations, combine header analysis with authentication results (SPF, DKIM, DMARC) to assess legitimacy and path integrity.