kuvertii — read what an email says about you

Where to find the raw message

On a computer

Gmail — ⋮ → Show original
Apple Mail — View → Message → Raw Source
Outlook — File → Properties → Internet headers
Thunderbird — Ctrl+U

On a phone

No mail app on a phone shows a raw message, so each of these is a detour around the app rather than a setting inside it.

iPhone Mail has no raw view. Drag the message onto a minimised compose window: it attaches as an .eml you can save to Files and open here. On an iPad, drag it into Files in Split View.
The Gmail app has no Show original. Open mail.google.com in the browser, request the desktop site, then ⋮ → Show original → Download original.
The Outlook app has none either. Outlook on the web, desktop site → More actions → Save as → .eml.
Proton's app has ⋮ → View headers → Share. That gives the header alone, so every body finding will be missing.

What this finds

Who it was really addressed to: Your address is usually in To: once and encoded three more times — in the unsubscribe token, the bounce address, and mailer fields stored backwards so they do not read as text.
Who else was shown your address: Everyone in To and Cc can read every other name there. Sent to a crowd, the message hands each of them the whole list — Bcc exists so that this does not happen.
That your copy is yours alone: Bulk mail is not sent to a list, it is sent to you specifically. Every reply, bounce, click and unsubscribe maps back to your address by design — and the sending platform is named, so you can see which system holds a record about you.
Which list you are on: The list identifier is chosen internally and never meant to be read. Segment names like reactivation-90d say plainly how you have been filed.
The machine that wrote it: Client IP, mail program and timezone, where the sender left them. The same fields your own client writes into everything you send.
Where the unsubscribe link actually goes: Decoded from the link, not by visiting it — plus the structural tells that separate a real opt-out from a credential trap.
What the authentication results are worth: SPF, DKIM and DMARC ask whether a server may send for a domain. They never ask whether the mail is honest. Spam passes all three every day — and a signature can cover only the first few hundred bytes, leaving the rest free to be rewritten.
The route it took: Read from the bottom up, the first hop is the machine that generated the message — often an API call from a datacentre, not the brand on the envelope.
Where the links in the body go: The words of a link and its destination are written independently. Text naming one domain over a link that leaves for another, in-mail forms, bare IPs and lookalike hosts — read out of the message, never clicked.
What reading and clicking reveals: Tracking pixels named with the host they report to, your own address found inside the links — open, encoded, or hashed — and header ids that recur in a link, tying the message in your mailbox to your click. Nothing is loaded.
What travels attached: Attachments inventoried by name, type and size — double extensions and type-vs-bytes mismatches called out. Never opened beyond the first bytes, and links only the HTML version carries get their own card.