You will need to obtain the header from the notification or NDR (bounce back) of the original email.  This cannot be the header of the email the end user forwards.  See Gmail Header