Find, Copy and Paste Text From Apple Mail App Internal Headers

I want to be able to copy a specific email address from the raw source of email headers in the Mail App. The email address comes after a specific tag such as the auth-sender: email address.

  1. I already can launch Mail app.
  2. Select acct
  3. Select message.
  4. Open raw headers (probably)

What I need help with:
5. But, how do I find and copy the email address in front of a specific tag (i.e. auth-sender:)
6. Pate copied the address in Notes

Here is an example of what i want found.

In my Apple Mail app, I do NOT find any text in the Raw Source that is "auth-sender:" or anything close. But if that is what shows in your Mail Message then it should be easy to extract the email address.

Since you blurred the image where this text occurs in your message, I can't construct the RegEx. You will need to provide the full text around "auth-sender:" that includes the email in order for us to answer your question accurately.

Oh, what is the Keyboard Maestro action to use for constructing a regex and/or finding text?

You can't find the "auth-sender" tag because that depends on the email service provider you're using.

You can replace my example with reply-to address, it doesn't really matter.

Please provide the exact real-world source text in a Code Block, and then the result you want from it.

Here is a portion of the text, remember the email address won't always be the same that's why we must find the "auth-sender:" label first, its in bold. I want the email address after auth-sender

    Received: from mail pickup service by with Microsoft
	SMTPSVC; Tue, 3 Dec 2019 14:36:35 -0800
Received: from unverified ([]) by with M2W SMTP Server;
	Tue, 03 Dec 2019 14:36:34 -0800
Date: Wed, 04 Dec 2019 02:32:18 +0400
From: "Coordinador MLV" <>
To: <8736c321fd7cc61b92396b4f275614c7@fakeemail.comm>

Easy. Use this RegEx in a Search:

EMail address returned in the Capture Group.

For details, see regex101: build, test, and debug regex


Since a lot of us are now working from home. I've had to try building this macro again. I've built a macro to find the auth-sender tag in raw within Mail but I can't get it to find the email address using a regular expression auth-sender:\h+(.+)\h*\R*

See the image below!

Feedback Loop Account Macro (v9.0.5)

Always post BOTH the Macro image and file. See upload your macro .

I'll need your macro file to test.

Feedback Loop Account Macro (v9.0.5)

Feedback Loop Account.kmmacros (4.2 KB)

⌥⌘U = opens the raw file of an email
⌘F = opens Find

OK, I've completely rewritten your Macro.
It had several issues:

  1. You never copied the Raw Source data so that the Regex Search could be used.
  2. Even then, it appears there may be two different formats used in the MS Mail Raw Source Header to ID the Authenticated Sender.

I have added a second Regex as follows:

  1. Source : auth-sender:
  2. Source : Authentication-results: spf=none (sender IP is );

My Macro checks for #1, and if not found, tries #2.

Below is just an example written in response to your request. You will need to use as an example and/or change to meet your workflow automation needs.

Example Output


Please let us know if it meets your needs.


MACRO:   Extract Authenticated Sender from MS Mail Msg [Example]

-~~~ VER: 2.0    2020-07-17 ~~~
Requires: KM 8.2.4+   macOS 10.11 (El Capitan)+
(Macro was written & tested using KM 9.0+ on macOS 10.14.5 (Mojave))

DOWNLOAD Macro File:

Extract Authenticated Sender from MS Mail Msg [Example].kmmacros
Note: This Macro was uploaded in a DISABLED state. You must enable before it can be triggered.


Macro Author: @JMichaelTX

This is just an example written in response to the below KM Forum Topic. You will need to use as an example and/or change to meet your workflow automation needs.


  • Carefully review the Release Notes and the Macro Actions
    • Make sure you understand what the Macro will do.
    • You are responsible for running the Macro, not me.


  • While I have given this a modest amount of testing, and to the best of my knowledge will do no harm, I cannot guarantee it.
  • If you have any doubts or questions:
    • Ask first
    • Turn on the KM Debugger from the KM Status Menu, and step through the macro, making sure you understand what it is doing with each Action.

Great job as usual, @JMichaelTX. I just wanted to point out that since this macro involves, this can actually be simplified further by using KM's %MailRawSource% token:

Extract Authenticated Sender from MS Mail Msg [Example].kmmacros (17.0 KB)


Thanks, Gabe. I rarely use Mail so I was not aware of that token.
Much better to use it.

1 Like

This one works (most of the time). Sometimes it doesn't find the auth-sender and I have to use my original Macro and manually copy the email address.

Also, I did add a copy to clipboard action to this macro so that if it does find an email address it get copied to the system clipboard.

When it doesn't work, do you know why?
Have you looked at the Raw Source to find the auth-sender?

If you have, then if you will post the text around that section I'll see if there is a tweak to the RegEx that will match it.

Received: from ( [])

by (SMTP Server) with ESMTP id 4B7nhm5Ft5zKm40;

Sat, 18 Jul 2020 01:42:00 +0200 (CEST)

Received: from mail pickup service by with Microsoft SMTPSVC;

Thu, 16 Jul 2020 07:53:02 -0700


Received: from unverified ([]) by with M2W SMTP Server;

Here is my amateurish attempt to fix my original Macro. I added the steps below to the end of it.

Screen Shot 2020-07-20 at 12.08.04 PM

The only problem I'm running into is that sometimes, between the colon and the email address exists

  • 1 Space
  • 2 Spaces
  • 0 Spaces

And maybe we need to add some pauses to the macro for it to run smoothly?