{"id":3454,"date":"2026-10-28T06:23:22","date_gmt":"2026-10-28T13:23:22","guid":{"rendered":"https:\/\/cyber.mag212.com\/tools\/email-header-analyzer\/"},"modified":"2026-10-28T09:02:09","modified_gmt":"2026-10-28T16:02:09","slug":"email-header-analyzer","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/tools\/email-header-analyzer\/","title":{"rendered":"Analyseur d&#039;en-t\u00eate d&#039;e-mail"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-email-header-analyzer\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Tools<\/div><h2>Email header analyzer: <span>who really sent it?<\/span><\/h2><p>Paste the full headers of a suspicious email. We check SPF, DKIM and DMARC, compare the visible sender with the real one, and trace every server hop \u2014 all inside your browser.<\/p><div class=\"toc\"><a href=\"#m212eh-tool\">Analyze headers<\/a><a href=\"#m212eh-how\">How to get headers<\/a><a href=\"#m212eh-read\">Reading the results<\/a><\/div><\/section>\n<style>.m212x textarea{width:100%;min-height:190px;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font:13.5px\/1.5 \"JetBrains Mono\",\"DejaVu Sans Mono\",monospace}\n.m212x .eh-res{display:none;margin-top:18px}.m212x .verdict{display:flex;gap:14px;align-items:center;flex-wrap:wrap;background:#060a0f;border:1px solid var(--line2);border-radius:12px;padding:16px 18px;margin-bottom:12px}\n.m212x .verdict .v{font-size:22px;font-weight:800}\n.m212x .eh-auth{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,180px),1fr));gap:10px;margin:12px 0}\n.m212x .eh-auth div{background:#060a0f;border:1px solid var(--line2);border-radius:10px;padding:12px;min-width:0}\n.m212x .eh-auth span{display:block;font-size:11.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute)}\n.m212x .eh-auth b{font-size:20px}\n.m212x .fl{padding:10px 2px;border-bottom:1px solid var(--line);display:flex;gap:10px}.m212x .fl span{flex:none}\n.m212x .eh-kv td:first-child{color:var(--mute);white-space:nowrap;width:150px}.m212x .eh-kv td{word-break:break-word}\n.m212x .sn-tw{overflow-x:auto;-webkit-overflow-scrolling:touch}.m212x .sn-tw table{min-width:620px}<\/style>\n<section class=\"sec\" id=\"m212eh-tool\"><h3>Analyze headers<\/h3>\n<textarea id=\"m212ehin\" aria-label=\"Email headers\" spellcheck=\"false\" placeholder=\"Paste the full message headers here (everything from the top down to the first blank line).\"><\/textarea>\n<div style=\"display:flex;gap:8px;flex-wrap:wrap;margin-top:10px\"><button type=\"button\" class=\"pri\" id=\"m212ehgo\">Analyze<\/button><button type=\"button\" id=\"m212ehex\">Load a sample phishing header<\/button><button type=\"button\" id=\"m212ehclr\">Clear<\/button><\/div>\n<p class=\"small\" style=\"margin-top:10px\">\ud83d\udd12 Headers are analysed only in your browser and never sent or stored. They can still contain names and email addresses \u2014 don&#8217;t paste them into tools you don&#8217;t trust.<\/p>\n<div class=\"eh-res\" id=\"m212ehres\">\n<div class=\"verdict\"><div class=\"v\" id=\"m212ehv\"><\/div><div class=\"small\" id=\"m212ehsum\"><\/div><\/div>\n<div class=\"eh-auth\" id=\"m212ehauth\"><\/div>\n<h4>Findings<\/h4><div id=\"m212ehf\"><\/div>\n<h4>Sender details<\/h4><div class=\"sn-tw\"><table class=\"eh-kv\" id=\"m212ehkv\"><\/table><\/div>\n<h4>Delivery path <span class=\"small\" style=\"font-weight:400\">\u2014 oldest hop first<\/span><\/h4><div class=\"sn-tw\" id=\"m212ehhops\"><\/div>\n<div class=\"callout\"><b>Passing checks don&#8217;t prove an email is safe.<\/b> Scammers can register look-alike domains with perfect SPF, DKIM and DMARC. Always check that the domain is exactly the one you expect, and verify payment or password requests through a channel you already trust.<\/div>\n<\/div><\/section>\n<section class=\"sec\" id=\"m212eh-how\"><h3>How to get the full headers<\/h3><div class=\"sn-tw\"><table><tr><th>Email app<\/th><th>Steps<\/th><\/tr>\n<tr><td><b>Gmail (web)<\/b><\/td><td>Open the message \u2192 \u22ee (More) \u2192 <b>Show original<\/b> \u2192 copy everything above the message body.<\/td><\/tr>\n<tr><td><b>Outlook (web \/ new Outlook)<\/b><\/td><td>Open the message \u2192 \u22ef \u2192 <b>View<\/b> \u2192 <b>View message source<\/b> (or <b>View message details<\/b>).<\/td><\/tr>\n<tr><td><b>Outlook (classic desktop)<\/b><\/td><td>Open the message \u2192 <b>File<\/b> \u2192 <b>Properties<\/b> \u2192 copy the <b>Internet headers<\/b> box.<\/td><\/tr>\n<tr><td><b>Apple Mail<\/b><\/td><td>Select the message \u2192 <b>View<\/b> \u2192 <b>Message<\/b> \u2192 <b>All Headers<\/b> (or Raw Source).<\/td><\/tr>\n<tr><td><b>Yahoo Mail<\/b><\/td><td>Open the message \u2192 \u22ef \u2192 <b>View raw message<\/b>.<\/td><\/tr>\n<tr><td><b>Thunderbird<\/b><\/td><td>Open the message \u2192 <b>View<\/b> \u2192 <b>Message Source<\/b> (Ctrl+U).<\/td><\/tr><\/table><\/div><\/section>\n<section class=\"sec\" id=\"m212eh-read\"><h3>Reading the results<\/h3>\n<ul class=\"l\"><li><b>SPF<\/b> checks whether the sending server is allowed to send for the <i>envelope<\/i> domain (Return-Path), not the From address you see.<\/li>\n<li><b>DKIM<\/b> is a cryptographic signature. It proves the signing domain (<code>d=<\/code>) sent the message and that the signed parts weren&#8217;t changed.<\/li>\n<li><b>DMARC<\/b> ties them together: it passes only if SPF or DKIM passes <i>and<\/i> that domain aligns with the visible From domain. A DMARC fail on a message claiming to be your bank is a strong spoofing sign.<\/li>\n<li><b>Reply-To mismatch<\/b> is the classic business-email-compromise trick: the email looks like it&#8217;s from your CEO, but replies go to the attacker.<\/li>\n<li><b>Received<\/b> lines are added by each server, newest at the top. Only the lines added by your own provider can be trusted; anything below them can be forged.<\/li><\/ul>\n<p class=\"small\">Got a suspicious link in the email too? Check it with the <a href=\"\/tools\/link-checker\/\">suspicious link checker<\/a>. Learn the red flags on <a href=\"\/stay-safe\/\">Stay Safe<\/a>.<\/p><\/section>\n<p class=\"small noprint\" style=\"margin:-8px 0 18px;padding:0 4px\">\u2696\ufe0f For education and use on systems you own or are authorised to test. Results are automated guidance, not a professional audit. See our <a href=\"\/terms-of-use\/\">terms of use<\/a> and <a href=\"\/privacy-policy\/\">privacy policy<\/a>.<\/p>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, plus security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<script>\n(function(){\nvar root=document.getElementById('m212-email-header-analyzer'); if(!root) return;\nvar SAMPLE=['Delivered-To: alex@example.org','Received: by 2002:a05:6a10:8f0e:b0:5a1:2b3c:4d5e with SMTP id x14csp123456pxb;','        Mon, 26 Oct 2026 09:14:52 -0700 (PDT)','Received: from mail.secure-paypa1-billing.example.net (mail.secure-paypa1-billing.example.net. [203.0.113.45])','        by mx.example.org with ESMTPS id a1si2345678qkb.12.2026.10.26.09.14.50','        for <alex@example.org>; Mon, 26 Oct 2026 09:14:50 -0700 (PDT)','Received: from [198.51.100.23] (unknown [198.51.100.23])','        by mail.secure-paypa1-billing.example.net (Postfix) with ESMTPA id 4F2A1C0123','        for <alex@example.org>; Mon, 26 Oct 2026 16:14:47 +0000 (UTC)','Authentication-Results: mx.example.org;','       spf=softfail (domain of transitioning billing@secure-paypa1-billing.example.net does not designate 203.0.113.45 as permitted sender) smtp.mailfrom=billing@secure-paypa1-billing.example.net;','       dkim=none;','       dmarc=fail (p=REJECT sp=REJECT dis=NONE) header.from=paypal.com','Return-Path: <billing@secure-paypa1-billing.example.net>','From: \"PayPal Service <service@paypal.com>\" <service@paypal.com>','Reply-To: <paypal.resolution.team@gmail.com>','To: alex@example.org','Subject: Your account has been limited - action required','Date: Mon, 26 Oct 2026 16:14:45 +0000','Message-ID: <20261026161445.4F2A1C0123@mail.secure-paypa1-billing.example.net>','X-Mailer: PHPMailer 6.8.0','MIME-Version: 1.0','Content-Type: text\/html; charset=UTF-8'].join('\\n');\nvar FREE=['gmail.com','googlemail.com','outlook.com','hotmail.com','live.com','yahoo.com','aol.com','icloud.com','me.com','proton.me','protonmail.com','gmx.com','mail.com','yandex.com','zoho.com'];\nvar SLD=['co','com','org','net','gov','ac','edu'];\nfunction org(d){ if(!d) return ''; d=d.toLowerCase().replace(\/\\.$\/,''); var p=d.split('.'); if(p.length<=2) return d; var n=p.length; if(p[n-1].length===2) if(SLD.indexOf(p[n-2])>-1) return p.slice(-3).join('.'); return p.slice(-2).join('.'); }\nfunction parse(raw){\n  var lines=String(raw).replace(\/\\r\/g,'').split('\\n'), hs=[], started=false;\n  for(var i=0;i<lines.length;i++){ var l=lines[i]; if(\/^\\s*$\/.test(l)){ if(started) break; else continue; } started=true;\n    if(\/^[ \\t]\/.test(l)){ if(hs.length) hs[hs.length-1][1]+=' '+l.trim(); continue; }\n    var m=l.match(\/^([!-9;-~]+):\\s*(.*)$\/); if(m) hs.push([m[1].toLowerCase(),m[2]]); }\n  return hs;\n}\nfunction all(hs,n){ return hs.filter(function(h){ return h[0]===n; }).map(function(h){ return h[1]; }); }\nfunction one(hs,n){ var a=all(hs,n); return a.length?a[0]:''; }\nfunction addr(v){ if(!v) return {name:'',email:'',domain:''}; var m=v.match(\/<([^<>]+@[^<>]+)>\\s*$\/), email, name=''; if(m){ email=m[1].trim(); name=v.slice(0,v.lastIndexOf('<')).trim().replace(\/^\"|\"$\/g,''); } else { var m2=v.match(\/[^\\s<>\"]+@[^\\s<>\"]+\/); email=m2?m2[0]:''; } email=email.replace(\/^mailto:\/i,''); return {name:name,email:email,domain:(email.split('@')[1]||'').toLowerCase().replace(\/[>;\\s]\/g,'')}; }\nfunction res(text,k){ var re=new RegExp('\\\\b'+k+'\\\\s*=\\\\s*([a-z]+)','i'), m=text.match(re); return m?m[1].toLowerCase():''; }\nfunction analyze(raw){\n  var hs=parse(raw); if(!hs.length) return null;\n  var from=addr(one(hs,'from')), rp=addr(one(hs,'return-path')), rt=addr(one(hs,'reply-to')), sender=addr(one(hs,'sender'));\n  var ar=all(hs,'authentication-results'), arT=ar.length?ar[0]:'', rspf=one(hs,'received-spf');\n  var spf=res(arT,'spf') || (rspf.match(\/^\\s*([a-z]+)\/i)||['',''])[1].toLowerCase(), dkim=res(arT,'dkim'), dmarc=res(arT,'dmarc');\n  var dsig=all(hs,'dkim-signature'), dds=dsig.map(function(s){ var m=s.match(\/\\bd=([^;\\s]+)\/); return m?m[1].toLowerCase():''; }).filter(Boolean);\n  var dkimD=(arT.match(\/header\\.d=([^;\\s)]+)\/i)||arT.match(\/header\\.i=@([^;\\s)]+)\/i)||['',''])[1].toLowerCase() || dds[0] || '';\n  var f=[], pts=0; function add(w,lvl,msg){ pts+=w; f.push([lvl,msg]); }\n  if(!from.email) add(2,'warn','No valid From address was found.');\n  if(dmarc==='fail') add(4,'bad','DMARC failed: the message claims to be from '+from.domain+' but could not prove it. This is a strong spoofing sign.');\n  else if(dmarc==='pass') f.push(['ok','DMARC passed for '+from.domain+'.']);\n  else if(arT) add(1,'warn','No DMARC result. The sender domain may not publish a DMARC policy, so spoofing it is easier.');\n  if(spf==='fail') add(3,'bad','SPF failed: the sending server is not authorised to send for '+(rp.domain||'the envelope domain')+'.');\n  else if(spf==='softfail') add(2,'warn','SPF soft-fail: the sending server is probably not authorised for '+(rp.domain||'the envelope domain')+'.');\n  else if(spf==='pass') f.push(['ok','SPF passed for '+(rp.domain||'the envelope domain')+'.']);\n  else if(spf) add(1,'warn','SPF result is \"'+spf+'\", which gives no protection.');\n  if(dkim==='fail') add(3,'bad','DKIM signature failed: the message was altered or the signature is forged.');\n  else if(dkim==='pass'){ if(org(dkimD)===org(from.domain)) f.push(['ok','DKIM passed and is aligned with the From domain ('+dkimD+').']); else add(1,'warn','DKIM passed, but for '+(dkimD||'another domain')+', not the From domain '+from.domain+'. Common with mailing services; check the sender is legitimate.'); }\n  else if(arT) add(1,'warn','No valid DKIM signature.');\n  if(!arT) if(!rspf) add(1,'warn','No Authentication-Results header found. Paste the headers as shown by your own mailbox provider to see SPF, DKIM and DMARC results.');\n  if(rt.domain) if(org(rt.domain)!==org(from.domain)) add(3,'bad','Replies go to '+rt.email+', a different domain from the sender ('+from.domain+'). This is a classic business-email-compromise trick.');\n  if(rp.domain) if(org(rp.domain)!==org(from.domain)) add(1,'warn','The envelope sender (Return-Path) is '+rp.domain+', not '+from.domain+'. Normal for newsletters and bulk-mail services, suspicious for personal or banking mail.');\n  var nm=from.name.match(\/[^\\s<>\"]+@[^\\s<>\"]+\/); if(nm) if(nm[0].toLowerCase()!==from.email.toLowerCase()) add(3,'bad','The display name contains a different address ('+nm[0]+') to make the email look like it comes from someone else.');\n  if(FREE.indexOf(from.domain)>-1) if(\/(bank|paypal|support|service|security|billing|account|microsoft|apple|amazon|irs|admin|helpdesk|ceo)\/i.test(from.name)) add(2,'warn','The sender uses a free webmail address ('+from.domain+') with an official-sounding name (\"'+from.name+'\").');\n  var b=['paypal','microsoft','apple','amazon','google','netflix','docusign','dhl','fedex','usps','chase','wellsfargo','bankofamerica'];\n  b.forEach(function(x){ var dom=rp.domain+' '+(one(hs,'message-id')); if(dom.indexOf(x)<0) if(dom.replace(\/1\/g,'l').replace(\/0\/g,'o').indexOf(x)>-1) add(3,'bad','The sending domain imitates \"'+x+'\" with look-alike characters.'); });\n  var rec=all(hs,'received'), hops=[];\n  rec.slice().reverse().forEach(function(r){ var semi=r.lastIndexOf(';'), dt=semi>-1?new Date(r.slice(semi+1).trim().replace(\/\\s*\\([^)]*\\)\\s*$\/,'')):null; var fm=(r.match(\/\\bfrom\\s+(.+?)\\s+(?=by\\s)\/i)||['',''])[1], by=(r.match(\/\\bby\\s+(\\S+)\/i)||['',''])[1], ip=(r.match(\/\\[((?:\\d{1,3}\\.){3}\\d{1,3}|[0-9a-f:]+:[0-9a-f:]+)\\]\/i)||['',''])[1], w=(r.match(\/\\bwith\\s+(\\S+)\/i)||['',''])[1]; hops.push({from:fm,by:by,ip:ip,with:w,date:(dt ? (isNaN(dt.getTime()) ? null : dt) : null)}); });\n  for(var i=0;i<hops.length;i++){ hops[i].delay=null; if(i>0) if(hops[i].date) if(hops[i-1].date) hops[i].delay=Math.round((hops[i].date-hops[i-1].date)\/1000); }\n  hops.forEach(function(h){ if(h.delay!==null) if(h.delay<-300) h.warn='Clock goes backwards \u2014 this hop may be forged or a server clock is wrong.'; });\n  if(hops.some(function(h){ return h.warn; })) add(1,'warn','Timestamps in the delivery path go backwards. Earlier hops may be forged.');\n  var xm=one(hs,'x-mailer'); if(\/phpmailer|swiftmailer|sendblaster|mass ?mail\/i.test(xm)) add(1,'warn','Sent with a scripting or bulk-mail library ('+xm+'), unusual for a bank or real company support desk.');\n  return {hs:hs,from:from,rp:rp,rt:rt,sender:sender,spf:spf,dkim:dkim,dmarc:dmarc,dkimD:dkimD,f:f,pts:pts,hops:hops,subj:one(hs,'subject'),date:one(hs,'date'),mid:one(hs,'message-id'),xoip:one(hs,'x-originating-ip')};\n}\nfunction esc(t){ var d=document.createElement('div'); d.textContent=t==null?'':String(t); return d.innerHTML; }\nfunction badge(v){ if(!v) return '<b style=\"color:var(--mute)\">\u2014<\/b>'; var c=v==='pass'?'var(--green)':(v==='fail'?'var(--red)':'var(--amber)'); return '<b style=\"color:'+c+'\">'+esc(v.toUpperCase())+'<\/b>'; }\nfunction show(){\n  var r=analyze(document.getElementById('m212ehin').value), box=document.getElementById('m212ehres');\n  if(!r){ box.style.display='none'; return; } box.style.display='block';\n  var v=document.getElementById('m212ehv');\n  if(r.pts>=4){ v.textContent='\ud83d\udea9 High risk: likely spoofed or phishing'; v.style.color='var(--red)'; } else if(r.pts>=2){ v.textContent='\u26a0\ufe0f Suspicious: verify before acting'; v.style.color='var(--amber)'; } else if(r.pts>=1){ v.textContent='\ud83d\udfe1 Minor warning signs'; v.style.color='var(--amber)'; } else { v.textContent='\u2705 No common spoofing signs found'; v.style.color='var(--green)'; }\n  document.getElementById('m212ehsum').textContent=(r.subj?'Subject: '+r.subj:'')+(r.hops.length?' \u00b7 '+r.hops.length+' server hops':'');\n  document.getElementById('m212ehauth').innerHTML='<div><span>SPF<\/span>'+badge(r.spf)+'<\/div><div><span>DKIM<\/span>'+badge(r.dkim)+'<\/div><div><span>DMARC<\/span>'+badge(r.dmarc)+'<\/div>';\n  var fl=document.getElementById('m212ehf'); fl.innerHTML='';\n  if(!r.f.length) r.f.push(['ok','No common spoofing patterns found.']);\n  r.f.sort(function(a,b){ var o={bad:0,warn:1,ok:2}; return o[a[0]]-o[b[0]]; }).forEach(function(x){ var d=document.createElement('div'); d.className='fl'; var i=document.createElement('span'); i.textContent=x[0]==='bad'?'\ud83d\udea9':(x[0]==='warn'?'\u26a0\ufe0f':'\u2705'); var t=document.createElement('div'); t.textContent=x[1]; d.appendChild(i); d.appendChild(t); fl.appendChild(d); });\n  var kv=[['From (shown)',r.from.name],['From (address)',r.from.email],['Reply-To',r.rt.email],['Return-Path',r.rp.email],['Sender',r.sender.email],['DKIM signing domain',r.dkimD],['Date',r.date],['Message-ID',r.mid],['X-Originating-IP',r.xoip]];\n  document.getElementById('m212ehkv').innerHTML=kv.filter(function(x){ return x[1]; }).map(function(x){ return '<tr><td>'+x[0]+'<\/td><td class=\"mono\">'+esc(x[1])+'<\/td><\/tr>'; }).join('');\n  var h='<table><tr><th>#<\/th><th>From<\/th><th>By<\/th><th>IP<\/th><th>Protocol<\/th><th>Delay<\/th><\/tr>';\n  r.hops.forEach(function(x,i){ h+='<tr><td>'+(i+1)+'<\/td><td class=\"mono\">'+esc(x.from||'\u2014')+'<\/td><td class=\"mono\">'+esc(x.by||'\u2014')+'<\/td><td class=\"mono\">'+esc(x.ip||'\u2014')+'<\/td><td>'+esc(x.with||'\u2014')+'<\/td><td>'+(x.delay===null?'\u2014':(x.delay+' s'))+(x.warn?' \u26a0\ufe0f':'')+'<\/td><\/tr>'; });\n  document.getElementById('m212ehhops').innerHTML=r.hops.length?h+'<\/table>':'<p class=\"small\">No Received headers found.<\/p>';\n}\ndocument.getElementById('m212ehgo').addEventListener('click',show);\ndocument.getElementById('m212ehex').addEventListener('click',function(){ document.getElementById('m212ehin').value=SAMPLE; show(); });\ndocument.getElementById('m212ehclr').addEventListener('click',function(){ document.getElementById('m212ehin').value=''; document.getElementById('m212ehres').style.display='none'; });\nwindow.m212eh=analyze;\n})();\n<\/script>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBER \u00b7 Tools Email header analyzer: who really sent it? Paste the full headers of a suspicious email. We check SPF, DKIM and DMARC, compare the visible sender with the real one, and trace every server hop \u2014 all inside your browser. Analyze headersHow to get headersReading the results Analyze headers AnalyzeLoad a sample [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3386,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3454","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3454"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3454\/revisions"}],"predecessor-version":[{"id":3470,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3454\/revisions\/3470"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3386"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}