What evidence is needed when reporting email abuse?

Full message headers: complete headers showing routing and authentication, not just visible From/To/Subject. Headers enable investigation of actual source.

Message content: body content demonstrating abuse type (phishing indicators, spam content, malware). Screenshots may supplement but text is more useful.

Context: when received, targeting patterns observed, number of instances, and any additional identifying information. Context helps prioritize and investigate effectively.