Email Header Analyzer
Paste the headers of a suspicious email to see whether SPF, DKIM and DMARC passed, where it really came from and where replies go.
Guide & FAQHow to get the headers · What SPF, DKIM and DMARC actually tell you · Which lines can be trusted · What this page does not do · Frequently asked questions
How to get the headers
| Mail app | Where the headers are |
|---|---|
| Gmail (web) | Open the message → ⋮ next to Reply → Show original → Copy to clipboard, or Download original for an .eml file |
| Outlook (web, new Outlook) | Open the message → ⋯ → View → View message source |
| Outlook (classic desktop) | Open the message in its own window → File → Properties → copy the Internet headers box |
| Apple Mail | View → Message → Raw Source (⌥⌘U) |
| Thunderbird | View → Message Source (Ctrl+U / ⌘U) |
| Yahoo Mail | Open the message → ⋯ → View raw message |
Pasting the whole source is fine: the page stops at the first blank line after the headers and ignores the body.
What SPF, DKIM and DMARC actually tell you
SPF checks that the server which handed over the message is allowed to send for the envelope domain (the Return-Path, the address bounces go to). DKIM checks a signature made by whichever domain is named in d=. Neither looks at the From address you see in your inbox, which is why a phishing mail can pass both: the sender signs and sends with their own domain and writes someone else's in From.
DMARC closes that gap. It passes only when SPF or DKIM passed and the domain that passed is the From domain (or the same organisation's domain: mail.example.com counts for example.com). The table marks that as "matches From". A pass that does not match From proves only that someone else's domain sent it.
| Result | Meaning |
|---|---|
| pass | The check succeeded |
| fail | The check ran and the message does not satisfy it; for DMARC, the From domain did not authorise this message |
| softfail | SPF only: the domain says this server is probably not one of its own, but asks receivers not to reject outright |
| neutral / none | The domain publishes no opinion, or no record at all; nothing is proved either way |
| temperror / permerror | The check could not be completed (DNS timeout) or the domain's record is broken |
Which lines can be trusted
Each server that handles a message adds a Received line at the top, so the headers read from newest (top) to oldest (bottom). The lines added by your own provider — the top ones — are reliable. Everything below the first server outside your provider was written by the sender's side and can be invented, including fake Received and Authentication-Results lines. That is why this page judges the message by the topmost Authentication-Results header only, and lists any others separately.
What this page does not do
It does not look anything up. The results shown are the ones your mail provider recorded when the message arrived; the page cannot re-run SPF or check a DKIM signature itself, because that needs DNS queries, and its security policy does not let it contact any other site. It also does not judge the body, the links or attachments: a message from a genuine, fully authenticated domain can still be a scam if that domain belongs to the scammer. Check the domain name itself.
Frequently asked questions
Are the headers I paste uploaded?
No. They are parsed by the script on this page, in your browser. The page’s security policy does not allow it to send data to any other site, which you can check on the privacy page. Headers can contain your address and internal server names, so that matters.
SPF and DKIM passed. Why does it still say the From address is not verified?
Because they passed for a different domain. SPF and DKIM vouch for the envelope domain and the signing domain, which a sender chooses. Only when one of those is the From domain (or a subdomain of the same organisation) does it say anything about the name you see. That is what DMARC checks, and what the "matches From" column shows.
Can I find the sender’s real IP address?
The page shows the IP address recorded by the first server outside the sender’s own network that your provider can vouch for. For mail sent from Gmail, Outlook.com and most webmail, that is the provider’s server, not the person’s computer: those services do not pass on the user’s IP address.
Why is a delay negative?
Each server stamps its own clock. If one server’s clock is a few seconds or minutes off, the next hop appears to happen before the previous one. Small negative delays are clock drift, not tampering.
Can it open .msg files from Outlook?
No. A .msg file is a binary Outlook format. Use View message source or the Internet headers box instead and paste the text, or save the message as .eml from another client.