Email Header Analyzer
Is this email really from who it claims to be?
Paste a raw email header to trace its routing path, find the real sender IP, check SPF / DKIM / DMARC authentication, and spot spoofing signs — in seconds.
How to get the raw header
Choose your email client for copy-paste steps, or paste a header you already have.
1. Choose your email client
Open the email, click the ⋮ (More) menu in the top-right, choose “Show original”, then copy the full text.
2. Paste the header into the analyzer
3. Read the verdict: authentication results + spoofing indicators
100% private — headers are parsed locally in your browser and never uploaded.
How to Check If an Email Is Fake: 3 Steps
Step 1 — Copy the raw header from your email client
In Gmail open the email and click ⋮ → Show original. In Outlook on the web click ⋯ → View → View message source. The raw header is a block of technical lines at the top of the message source — copy that whole block.
Step 2 — Paste the header and let the analyzer decode it
Paste the copied header into the parser above. It decodes the From and Reply-To addresses, the full Received routing chain with each hop’s IP and delay, the ultimate source IP, and the SPF / DKIM / DMARC authentication results.
Step 3 — Read the verdict and act
If authentication shows pass and addresses match, the message most likely really comes from the claimed domain. If you see SPF or DKIM fail, mismatched Reply-To / Return-Path, or a suspicious source IP — do not reply and do not click links. Test any link with the link checker first.
How to Check SPF, DKIM and DMARC for a Domain
Step 1 — Check the SPF record
SPF (Sender Policy Framework) is a TXT record that lists every server allowed to send mail for the domain. Go to the SPF / DMARC Check tab, enter the domain, and read the enforcement tag: -all is strict, ~all is soft-fail, and ?all or a missing policy means the domain is open to spoofing. To inspect the raw TXT value, run the same domain through our DNS lookup tool.
Step 2 — Verify the DKIM signature
DKIM (DomainKeys Identified Mail) signs each message with a private key and publishes the matching public key as a TXT record at selector._domainkey.yourdomain.com. When you paste a header, this analyzer reads the DKIM selector for you. On the SPF / DMARC Check tab, press Check DKIM to confirm the key exists — if the header also shows dkim=pass, the message was signed and arrived unmodified.
Step 3 — Confirm the DMARC policy
DMARC tells receiving mail servers what to do when SPF or DKIM fails: p=reject blocks the mail, p=quarantine sends it to spam, and p=none only reports without blocking. A domain with no DMARC record has no protection policy, so spoofed mail is more likely to reach inboxes. Check any domain you send from and work toward p=quarantine or p=reject.
Email Header Analyzer FAQ
What is an email header analyzer?
A: An email header analyzer decodes the raw metadata that every email carries — routing path, sending server, and authentication results — and turns it into a human-readable report. It helps you verify who really sent a message and spot forged or phishing emails.
How do I view email headers in Gmail or Outlook?
A: In Gmail, open the email, click the three-dot menu (⋮) at the top right and choose “Show original”. In Outlook on the web, open the email, click ⋯ → View → View message source. Copy the full raw header text and paste it into this analyzer.
What are SPF, DKIM and DMARC?
A: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC are the three email authentication standards. SPF verifies the sending server is authorized by the domain, DKIM verifies the message was signed and unchanged in transit, and DMARC tells receivers what to do when SPF or DKIM fails. Together they make sender-address spoofing much harder.
How can I tell if an email is spoofed?
A: Look for three signs: authentication results showing SPF or DKIM “fail”, a Reply-To or Return-Path address that differs from the From domain, and a routing (Received) chain that does not match the claimed sender. This analyzer checks all three automatically and lists any risk indicators.
What does “SPF fail” mean?
A: SPF fail means the email was not sent from a server authorized by the domain’s SPF record. It is a strong signal the message may be forged — but not conclusive alone, because some legitimate senders misconfigure SPF. Combine it with the DKIM and DMARC results for a confident verdict.
Why should I check email headers at all?
A: Phishing depends on forged sender addresses, and email headers are the only place to see the true routing and authentication data behind a message. The APWG recorded 971,181 phishing attacks in Q1 2026 alone, and Verizon's 2026 Data Breach Investigations Report finds phishing is the entry vector in 16% of breaches — with human error and social engineering involved in 62%. Business email compromise attempts average $61,732 per request. Checking a suspicious header takes a minute and can prevent credential theft, malware, or invoice fraud.
Is my email header data private?
A: Yes. Any header you paste is parsed locally in your browser using JavaScript — nothing is uploaded. This tool makes no network request with your header content, so a sensitive internal email header stays on your device.
What is the Received chain in an email header?
A: The Received chain is a list of “Received:” lines added by each mail server the message passed through. Read from the bottom, it shows the route from the original sender to you, and the last Received line typically reveals the ultimate source IP of the message.
How do I check SPF, DKIM and DMARC for my own domain?
A: Switch to the SPF / DMARC Check tab, type your domain, and press Check Domain. The tool queries live DNS and shows your SPF record with its enforcement tag, your DMARC policy, and lets you verify any DKIM selector. Fixing all three is the fastest way to keep your legitimate mail out of spam and stop attackers from spoofing your domain.
How can I decode an email header myself?
A: Read the Received lines from bottom to top — the lowest Received line is normally where the message entered the internet, and its IP is the likely original sender. Then check Authentication-Results for the spf, dkim and dmarc values, and compare the From address with Return-Path and Reply-To. This analyzer automates all of that in a single paste.
What does it mean when SPF fails but DKIM passes?
A: SPF fail with DKIM pass usually means the message was relayed, or the sending server is simply not listed in the domain's SPF record, while the message content is genuinely signed by the domain. It is less suspicious than both failing, but still worth caution — check the From domain and the Received chain before trusting it.
Can email headers be forged? How reliable are they?
A: Headers can be edited, but not every field is equally easy to fake. The Received chain and Authentication-Results are added by mail servers you do not control, which makes them the most trustworthy signals — and the reason phishing detection relies on them. From, Reply-To and Subject are set by the sender and easy to spoof, so a mismatch between them and the authenticated domain is the strongest red flag.