About email header analyzer
Every email carries hidden header lines that record its journey from sender to inbox. Reading them helps you spot spoofed or suspicious messages.
What to look at
- Received lines: the servers the message passed through, newest at the top.
- From, Reply-To and Return-Path: if they point to unrelated domains, be careful.
- SPF, DKIM and DMARC results: 'pass' means the domain's checks succeeded; 'fail' is a warning sign.
How to get the headers
In most mail apps, open the message menu and choose Show original, View source or View message headers, then copy the text here.
Remember
Headers can be forged in parts, and passing checks does not prove a message is safe. Do not click links or open attachments from unexpected senders.
A worked example
A message claiming to be from your bank has a From address at the bank's domain but an authentication result of SPF fail and a Return-Path on an unrelated domain. That mismatch is a strong sign of spoofing. Do not click links in such a message.
