Email header analyser
Paste the raw headers of a suspicious email. The analyser explains who really sent it, whether the sender passed authentication and how the message reached you.
The headers are parsed in your browser and never sent anywhere.
How it works
The analyser reads the header block the way a mail server does: it joins folded lines, decodes encoded subjects and names, and lists the Received headers as a delivery path with the delay at each hop.
For authentication it trusts only the topmost Authentication-Results header, the one your own mail provider added. It reports the SPF, DKIM and DMARC results, checks whether the DKIM signature and the bounce address belong to the From domain, and looks for common impersonation tricks: a different address hidden in the display name, a well-known brand in the name, replies diverted to another domain, and missing or odd dates.
Reading the result
DMARC is the check that protects the From address you see. A pass means the domain owner’s own SPF or DKIM confirmed it; a fail means the address is very likely forged. SPF and DKIM on their own can pass for any domain the sender controls.
Everything below your provider’s own lines can be written by the sender, so treat earlier hops as claims rather than facts.
Questions
Where do I find the raw headers?
Gmail: open the message, choose More (⋮) and Show original. Outlook on the web: More actions, View, View message source. Outlook for Windows: File, Properties, Internet headers. Apple Mail: View, Message, All Headers. Thunderbird: View, Message Source.
Are my headers sent anywhere?
No. The headers are parsed in your browser and nothing is uploaded. Headers contain your email address and network details, so think twice before pasting them into online services.
Why can a phishing email pass SPF and DKIM?
SPF and DKIM confirm the domain that sent or signed the message, which can be the attacker’s own domain. Only DMARC ties those results to the From address you see.
What should I do if the result shows signs of forgery?
Do not click links, open attachments or reply. Report the message as phishing in your mail program and tell your IT or security team.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Incident responseRelated articles
-
How to spot a phishing link before you click
Learn to read a URL like an attacker builds it - registrable domains, lookalike and punycode domains, the @ trick, open redirects, shorteners and new TLDs.
-
SPF, DKIM and DMARC explained - a safe path to p=reject
How SPF, DKIM and DMARC stop others sending email as your domain, how to move from p=none to p=reject safely, and the mistakes that break mail.