Email header analyzer
Headers reveal whether an email really came from who it claims to be from. Paste them here and the tool turns them into plain-English warnings – nothing is sent anywhere.
How to use it
- Open the message headers. Gmail on a computer: click the More icon next to Reply, choose Show original, then Copy to clipboard. New Outlook and Outlook on the web: More actions → View → View message details. Classic Outlook: double-click the message to open it, choose File → Properties and copy the Internet headers box.
- Paste the text into the box. It can be the whole original, body included – the tool only reads the headers above the first blank line.
- Click Analyse headers and read the Summary first. Take red warnings seriously.
- If the message failed authentication or replies go somewhere else, don't reply or click any links, and check with the sender another way – for example by phoning a number from their official website.
How it works
The sender name and address you see in your mail app are just text the sender can type in themselves. The headers tell the real story: every server along the way adds a line, and your mailbox provider's server records whether the sender passed authentication.
The tool pulls out:
- Key fields – From, Reply-To, the envelope address (Return-Path), subject and date, with encoded names and subjects decoded into readable text.
- Sender authentication – SPF, DKIM and DMARC results from the Authentication-Results header added by your mailbox provider (the topmost one counts), plus the DKIM signatures in the message.
- The message route – the servers from the Received headers, from the sender to you, with their IP addresses, times and the delays between them.
- Warnings – failed DMARC or SPF, a broken signature, a different domain for replies, a display name containing someone else's address (such as "support@bank.com" <anything@elsewhere.net>) and authentication that doesn't cover the domain in the From field.
Domains are matched in a simplified way: the same domain or a subdomain of it (for example news.company.com and company.com) counts as a match. The tool doesn't look anything up in DNS – it relies on the results your mail server has already written into the headers.
FAQ
Are the headers sent anywhere?
No. The whole analysis runs as a script in your browser. Nothing is sent to a server, stored or looked up in DNS. Headers contain your email address and sometimes an IP address, so avoid pasting them into other sites unless you need to.
What are SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for a domain. DKIM is a digital signature showing that the named domain signed the message and it wasn't changed in transit. DMARC ties both to the From address you see in your mail app: it only passes when SPF or DKIM successfully verifies that very domain. Your mailbox provider's server records the results in the Authentication-Results header.
The message passed DMARC. Does that mean it's safe?
No. Passing DMARC only shows that the message was sent by someone who controls the domain in the From field. Scammers register look-alike domains for banks and shops (with a hyphen or a different ending, for example). Always read which domain it actually is and check links with the link checker.
Why does the tool warn about a different reply address?
The Reply-To field decides where your reply goes. If it differs from the sender, you'll be answering someone other than the person you think. Fraudsters use this to send from compromised or borrowed addresses while collecting the replies themselves. It's normal for newsletters and help desks, though.
Can I find out where a scammer is writing from?
Only partly. Every server along the way adds a Received header, newest at the top. Only the ones added by your own provider's servers can be trusted – older lines may be forged by the sender. Large services such as Gmail and Outlook.com often leave out the sender's IP address altogether, and an IP address usually belongs to a server or an internet provider, not to a specific person.
Where should I report a phishing email?
In the UK, forward it to report@phishing.gov.uk; in the US, report it to the FTC at ReportFraud.ftc.gov. Mark it as phishing or spam in your mail service too. If you clicked a link and entered a password, follow our guide to a hacked account.
Sources
- RFC 8601 – Message Header Field for Indicating Message Authentication Status
- RFC 7208 – Sender Policy Framework (SPF)
- RFC 6376 – DomainKeys Identified Mail (DKIM)
- RFC 9989 – DMARC
- RFC 5322 – Internet Message Format (headers, the Received field)
- RFC 2047 – Encoded words in message headers
- Gmail Help – Trace an email with its full headers
- Microsoft Support – View internet message headers in Outlook
- NCSC – Report a suspicious email
- FTC – ReportFraud
Updated