Analyseur d'en-tête d'e-mail
MAG212 CYBER · Outils
Email header analyzer: who really sent it?
Paste the full headers of a suspicious email. We check SPF, DKIM and DMARC, compare the visible sender with the real one, and trace every server hop — all inside your browser.
Analyze headers
🔒 Headers are analysed only in your browser and never sent or stored. They can still contain names and email addresses — don’t paste them into tools you don’t trust.
Findings
Sender details
Delivery path — oldest hop first
Passing checks don’t prove an email is safe. Scammers can register look-alike domains with perfect SPF, DKIM and DMARC. Always check that the domain is exactly the one you expect, and verify payment or password requests through a channel you already trust.
How to get the full headers
| Email app | Steps |
|---|---|
| Gmail (web) | Open the message → ⋮ (More) → Show original → copy everything above the message body. |
| Outlook (web / new Outlook) | Open the message → ⋯ → View → View message source (or View message details). |
| Outlook (classic desktop) | Open the message → File → Properties → copy the Internet headers box. |
| Apple Mail | Select the message → View → Message → All Headers (or Raw Source). |
| Yahoo Mail | Open the message → ⋯ → View raw message. |
| Thunderbird | Open the message → View → Message Source (Ctrl+U). |
Reading the results
- SPF checks whether the sending server is allowed to send for the envelope domain (Return-Path), not the From address you see.
- DKIM is a cryptographic signature. It proves the signing domain (
d=) sent the message and that the signed parts weren’t changed. - DMARC ties them together: it passes only if SPF or DKIM passes and that domain aligns with the visible From domain. A DMARC fail on a message claiming to be your bank is a strong spoofing sign.
- Reply-To mismatch is the classic business-email-compromise trick: the email looks like it’s from your CEO, but replies go to the attacker.
- Received lines are added by each server, newest at the top. Only the lines added by your own provider can be trusted; anything below them can be forged.
Got a suspicious link in the email too? Check it with the suspicious link checker. Learn the red flags on Soyez prudent.
Besoin d'aide d'experts ?
MAG212 CYBER propose des services de conseil en réseaux et cybersécurité, ainsi que des séminaires de sécurité pour les organisations du monde entier.