Before you open an email if you mouse over it and right click you should get a smallish drop-down window, with options like - view email source, click on that and it opens up the header etc
.
I know how to find the headers, silly.
I have this program called emailTrackerPro that finds out all sorts of info too. FWIW, here's a few of the headers - the first two got through and the last one was stopped by ASSP:
Return-path: <duk@volia.net>
Envelope-to:
deleted.com
Delivery-date: Sat, 03 Mar 2012 16:52:36 -0800
Received: from localhost ([127.0.0.1] helo=cwh2.canadianwebhosting.com)
by cwh2.canadianwebhosting.com with smtp (Exim 4.69)
(envelope-from <duk@volia.net>)
id 1S3zgh-00060T-AP
for
deleted.com; Sat, 03 Mar 2012 16:52:35 -0800
Received: from 93-79-73-197.sumy.volia.net ([93.79.73.197] helo=93-79-73-197.sumy.volia.net)
with IPv4:25 by cwh2.canadianwebhosting.com; 3 Mar 2012 16:52:33 -0800
Message-ID: <237645782553.71112146237651@volia.net>
Date: Sun, 04 Mar 2012 01:52:35 +0100
From: support <nonreply@iksoing.in>
To: "me" <
deleted.com>
Subject: Join SP casino’s exclusive promotion
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-Assp-Delay:
deleted.com not delayed (spamlover); 3 Mar 2012
16:52:34 -0800
Return-path: <oduetuz@mm.pl>
Envelope-to:
deleted.com
Delivery-date: Sat, 03 Mar 2012 02:42:21 -0800
Received: from localhost ([127.0.0.1] helo=cwh2.canadianwebhosting.com)
by cwh2.canadianwebhosting.com with smtp (Exim 4.69)
(envelope-from <oduetuz@mm.pl>)
id 1S3mPq-0003Bq-W4
for
deleted.com; Sat, 03 Mar 2012 02:42:20 -0800
Received: from host-62-141-255-153.tomaszow.mm.pl ([62.141.255.153]
helo=host-62-141-255-153.tomaszow.mm.pl) with IPv4:25 by cwh2.canadianwebhosting.com;
3 Mar 2012 02:42:12 -0800
Message-ID: <184578731147.54882563275317@mm.pl>
Date: Sat, 03 Mar 2012 05:42:22 -0500
From: SP Gaming <noreply@kxl.com>
To: "me" <
deleted.com>
Subject: Join SP casino’s exclusive promotion
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Return-path: <do_not_reply@gcs-cpa.com>
Envelope-to:
deleted.com
Delivery-date: Sat, 03 Mar 2012 02:55:36 -0800
Received: from localhost ([127.0.0.1] helo=cwh2.canadianwebhosting.com)
by cwh2.canadianwebhosting.com with esmtp (Exim 4.69)
(envelope-from <do_not_reply@gcs-cpa.com>)
id 1S3mci-0004vF-8q
for
deleted.com; Sat, 03 Mar 2012 02:55:36 -0800
X-Assp-Delay:
deleted.com not delayed (spamlover); 2 Mar 2012
19:59:29 -0800
X-Assp-Score: 8 (HELO contains IP: '46-95-137-186.fibertel.com.ar')
X-Assp-Score: 2 (bombSubjectRe: 'casino')
X-Assp-Score: 6 (invalid HELO: '46-95-137-186.fibertel.com.ar')
X-Assp-Score: 56 (DNSBLcache: failed, 186.137.95.46 listed in
dnsbl-1.uceprotect.net, dnsbl.sorbs.net)
X-Assp-DNSBLcache: failed, 186.137.95.46 listed in dnsbl-1.uceprotect.net,
dnsbl.sorbs.net
X-Assp-Received-SPF: none ip=186.137.95.46 mailfrom=uoi@fibertel.com.ar
helo=46-95-137-186.fibertel.com.ar
X-Assp-Score: 11 (PTR invalid '')
X-Assp-Envelope-From:
uoi@fibertel.com.ar
X-Assp-Intended-For:
deleted.com
X-Assp-Version: 1.7.1.3(1.0.2)
X-Assp-ID: cwh2.canadianwebhosting.com ()
X-Assp-Original-Subject: =?UTF-8?Q?=20Join=20SP=20casino=92s=20?=exclusive
promotion
X-Spam-Status: yes
X-Assp-Spam-Reason: MessageScore (83) over limit (45)
X-Assp-Message-Totalscore: 83
Received: from 46-95-137-186.fibertel.com.ar ([186.137.95.46]
helo=46-95-137-186.fibertel.com.ar) with IPv4:25 by
cwh2.canadianwebhosting.com; 2 Mar 2012 19:59:27 -0800
Message-ID: <245818857102.82325188053128@fibertel.com.ar>
Date: Sat, 03 Mar 2012 04:59:30 +0100
From: SP support <do_not_reply@gcs-cpa.com>
To: "me" <
deleted.com>
Subject: Join SP casino’s exclusive promotion
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
X-Antivirus: avast! (VPS 120303-0, 03/03/2012), Inbound message
X-Antivirus-Status: Clean
EDIT: Also the emails are TEXT mails just with a link, there's no aff tag on the links.