What evidence is needed when reporting email abuse?

Someone sent you something sketchy, and now you want to report it. Good. But a complaint without evidence is hard to act on. Abuse desks need specific pieces of information to trace where the email actually came from and what it did.

Here's what a solid abuse report includes.

Full message headers are the most important piece. Not just the From, To, and Subject you see in your inbox. The full headers show the routing path, authentication results (SPF, DKIM, DMARC), and the originating IP address. That's what tells an investigator where the email actually came from, not just where it claimed to come from. To get them, look for a "Show original" or "View source" option in your email client. In Gmail, it's the three-dot menu, then "Show original". In Outlook, open the message and look under File, then Properties.

Message content matters too. Copy the full body text, not just a screenshot. Screenshots help, but investigators can't search or parse image text the way they can plain text. If the email contains a suspicious link, include it (don't click it), and note what kind of abuse you're seeing: phishing attempt, unsolicited bulk email, malware attachment, or impersonation.

Context rounds it out. When did you receive it? Have you seen similar ones before? How many instances? Is it targeting just you or others in your organization? Even small details like "I received three of these in 24 hours" help abuse teams triage faster.

If you no longer have the original message, that's a real limitation. A screenshot alone usually isn't enough to trace the source. If you can, check your trash or archive folder before it's gone for good. Some email clients also let you export a raw .eml file, which contains everything an abuse desk needs in one file.

If you're on the receiving end of someone else's abuse report and need to know how to process it, the process for handling incoming abuse complaints is worth reading alongside this.