Email Header Analyzer
Paste the full headers of an email to see where it really came from: the servers it passed through, whether SPF, DKIM and DMARC passed, and whether the reply address quietly goes somewhere else. In Gmail use Show original; in Outlook use View message source or Message details.
What to look for
DMARC fail or SPF fail on mail claiming to be from a bank, supplier or colleague is a strong sign of spoofing. A Reply-To on another domain is a classic invoice-fraud trick: the email looks like it is from your supplier, but your reply goes to the attacker.
For the message body itself, run it through our phishing email analyzer.
Frequently asked questions
Can email headers be faked?
Some can. The From line and Received lines added by the sender can be forged, but the results added by your own mail provider (Authentication-Results) and the top Received lines are reliable.
Is it safe to paste headers here?
Headers are parsed in your browser and not sent anywhere. They can contain names, email addresses and IPs, so avoid sharing them publicly.
What does DMARC=pass mean?
The message passed SPF or DKIM in a way that is aligned with the domain in the From address, so the sender is authorised by that domain.
More free security tools
Advertisement