Determine original sender

Sender name and sender address

In many email clients only the display name is shown instead of the send email address. This name does not have to be related to the send email address. This can often be displayed by hovering the mouse over the display name or clicking on it.

So it is possible that an e-mail obviously comes from a colleague, but the sender address is a fake external one. In case of suspicious e-mails you should always check the send e-mail address carefully.

Faked sender addresses

Send e-mail addresses can also be flashed. In some cases, e-mail servers allow e-mails to be sent/received with any sender address. This can be compared to a letter, where the sender can also be specified as desired.


E-mail servers try to prevent abuse.

The HTW offers a service to protect employees and students in the account service under the item Change settings in the section "Valid senders / abuse protection". Here you can define senders who are allowed to use their own address. From all others the e-mails will not be delivered.

Show source code

To see where an e-mail actually comes from, you can display the header of the e-mail as part of the source text. Here you can see the e-mail server, the source e-mail program and the source e-mail address.

  • HTW Webmail:
    Open the affected e-mail → Select "More (...)" in the upper navigation → Display source code
  • Mozilla Thunderbird:
    Open the affected e-mail and then use the key combination Ctrl+U
  • macOS Mail:
    Open affected e-mail → Display → e-mail → Default header or the key combination Shift+CMD+H
  • Microsoft Outlook:
    Open affected e-mail → File → Information → Properties