Email Header Analyzer
See where an email really came from, how long each hop took, and whether it passed SPF, DKIM and DMARC.
In most mail apps: open the message, then Show original, View source or Message headers.
Your text stays on your deviceHow?
How to analyze email headers
- Open the message in your mail app and copy its full headers.
- Paste them here.
- Check the verdicts, the addresses and the hops it took.
Questions
Where do I find the headers?
In most mail apps open the message, then choose Show original, View source or Message headers, and copy everything above the message text.
What do SPF, DKIM and DMARC mean here?
They are the checks the receiving server recorded. Pass means the message was sent by a server the sender's domain allows; fail is a strong sign of spoofing.
Why is a different Return-Path a warning?
Mailing services often use their own bounce address, but a phishing message also sends replies and bounces somewhere other than the From address.
Does it look anything up?
No. It reads only what is written in the headers, in your browser.