Email header analyzer
Trace an email back to the machine that really sent it, and read its SPF, DKIM and DMARC results.
Nothing leaves your browser. This tool does its work on your own machine — there is no upload, no server request, and nothing is stored.
How to get the headers
The headers are the part of an email you normally never see: a few dozen lines the mail servers write as the message travels. Every client hides them behind a differently named menu item.
- Gmail (web) — open the message, click the three dots at the top right of it, then Show original. Copy the block of text at the bottom.
- Outlook (web) — open the message, three dots, View, then View message details.
- Outlook (desktop) — double-click to open the message in its own window, then File, Properties, and read the box marked Internet headers.
- Apple Mail — View, Message, All Headers.
- Yahoo — the three dots on the message, then View raw message.
- Thunderbird — View, Headers, All, or press Ctrl+U for the source.
Reading the result
Read the hops from the bottom up
Each server that handles a message adds a Received line to the
top. So the bottom line is the earliest hop and the top line was added by
your own provider. This matters because a forger can write anything they like into
the lower lines — they were invented before your provider ever saw the message. The
hops you can trust are the ones nearest the top.
SPF, DKIM and DMARC in one paragraph
SPF asks whether the server that sent this was on the sending domain's approved list. DKIM checks a cryptographic signature over the message, proving it was signed by that domain and not altered since. DMARC ties the two to the address you actually see in the From line, and this is the one that matters: a message can pass SPF and DKIM for some domain the attacker owns while showing your bank's name in the From field. DMARC is what catches that, and its failure is the single strongest signal here.
The mismatches worth acting on
- Reply-To points somewhere else. The message looks like it is from a colleague, but your reply goes to an address the attacker controls. This is the mechanism behind most invoice fraud.
- Return-Path does not match From. Normal for mailing lists and marketing platforms, suspicious on a message that claims to be personal.
- The display name contains an address. A From of
"support@yourbank.com" <random@gmail.com>renders in most clients as just support@yourbank.com. The real address is the one in the angle brackets, always.
What headers cannot tell you
A perfectly clean set of headers does not make a message honest. A compromised real account sends mail that passes every check here, because it genuinely is the real account. If the content asks you to move money or change payment details, verify it by voice on a number you already had — no header analysis substitutes for that.
Common questions
Where do I find the full headers of an email?
In Gmail, open the message, click the three dots and choose "Show original". In Outlook on the web, open the message, click the three dots, then "View message details". In Apple Mail, use View, then Message, then All Headers. Copy everything from the top down to the blank line before the message body.
What does SPF pass but DMARC fail mean?
It usually means the message came from a server that some domain authorises, but the address shown in the From line belongs to a different domain than the one that passed SPF. That mismatch is called alignment failure, and it is the single most common signature of a spoofed sender.
Can email headers be faked?
Every header except the ones added by your own provider can be forged, and attackers routinely invent extra Received lines to hide the origin. Read the chain from the bottom up: the topmost hops were added by servers you trust, and they are the ones worth believing.
Does this send my email anywhere?
No. The parser runs entirely in your browser. Nothing you paste is uploaded, logged or stored, which matters because headers contain your own address.