Email Header Analyzer
MAG212 CYBER · Tools
Email header analyzer: who really sent it?
Paste the full headers of a suspicious email. We check SPF, DKIM and DMARC, compare the visible sender with the real one, and trace every server hop — all inside your browser.
Analyze headers
🔒 Headers are analysed only in your browser and never sent or stored. They can still contain names and email addresses — don’t paste them into tools you don’t trust.
Findings
Sender details
Delivery path — oldest hop first
Passing checks don’t prove an email is safe. Scammers can register look-alike domains with perfect SPF, DKIM and DMARC. Always check that the domain is exactly the one you expect, and verify payment or password requests through a channel you already trust.
How to get the full headers
| Email app | Steps |
|---|---|
| Gmail (web) | Open the message → ⋮ (More) → Show original → copy everything above the message body. |
| Outlook (web / new Outlook) | Open the message → ⋯ → View → View message source (or View message details). |
| Outlook (classic desktop) | Open the message → File → Properties → copy the Internet headers box. |
| Apple Mail | Select the message → View → Message → All Headers (or Raw Source). |
| Yahoo Mail | Open the message → ⋯ → View raw message. |
| Thunderbird | Open the message → View → Message Source (Ctrl+U). |
Reading the results
- SPF checks whether the sending server is allowed to send for the envelope domain (Return-Path), not the From address you see.
- DKIM is a cryptographic signature. It proves the signing domain (
d=) sent the message and that the signed parts weren’t changed. - DMARC ties them together: it passes only if SPF or DKIM passes and that domain aligns with the visible From domain. A DMARC fail on a message claiming to be your bank is a strong spoofing sign.
- Reply-To mismatch is the classic business-email-compromise trick: the email looks like it’s from your CEO, but replies go to the attacker.
- Received lines are added by each server, newest at the top. Only the lines added by your own provider can be trusted; anything below them can be forged.
Got a suspicious link in the email too? Check it with the suspicious link checker. Learn the red flags on Stay Safe.
Need expert help?
MAG212 CYBER offers network and cybersecurity consultation, plus security seminars for organisations around the world.