Analyse an email's headers
An email announces its sender, and nothing forces it to tell the truth. Its headers, on the other hand, record what actually happened. Paste them and read the difference.
SPF, DKIM, DMARC: what do they actually check?
Three mechanisms answer three different questions, and they only make sense together. SPF asks whether the server that sent the message was on the list of servers the domain authorises. DKIM asks whether the message carries a valid cryptographic signature applied by the domain, which also proves it was not modified in transit. DMARC asks what the domain wants done when one of the first two fails, and whether the domain that passed the checks really is the one displayed to the reader.
The trick this tool was built for
The most effective forgery does not touch the technical fields at all. It hides a decoy address inside the displayed name, because most mail clients show only that name. The message reads as coming from your bank while the real address belongs to somebody else entirely. This tool always shows the real address next to the displayed name, precisely to make that gap visible.
How to read the result
Three passes mean the sender is who they claim. It does not mean the message is honest: a genuine account can be compromised, and a scammer can perfectly authenticate their own domain. One failure, on the other hand, is a strong signal, especially on a message that claims to come from a bank, a public service or a delivery company. Those domains all publish strict policies.
Where do you find the raw source?
- Gmail: open the message, the three dots at the top right, then Show original.
- Outlook: File, then Properties, and copy the internet headers.
- Apple Mail: View, then Message, then Raw source.
- Thunderbird: View, then Message Source.
Frequently asked questions
Is the pasted message sent anywhere?
No. The headers are parsed inside your browser and never leave your device. Nothing is sent to our server, nothing is stored. You can cut your connection: the tool still works.
What is the difference between SPF, DKIM and DMARC?
SPF checks that the sending server was authorised by the domain. DKIM checks a cryptographic signature, which also proves the message was not altered in transit. DMARC states what the domain wants done when one of the first two fails, and requires the authenticated domain to match the one shown to the reader.
All three pass. Can I trust the message?
You can trust that the sender is who they claim to be. Not that the content is honest. A legitimate account can be compromised, and a scammer can authenticate their own domain perfectly well. Authentication answers who sent it, never whether it is true.
Why does the tool show the real address separately?
Because the most effective forgery hides a decoy address inside the displayed name, which is often all a mail client shows. Putting the two side by side makes the gap visible immediately.
SPF fails. Is the message necessarily fraudulent?
Not necessarily: a badly configured mailing list or a forwarded message can break SPF. But on a message that claims to come from a bank, a public service or a delivery company, an SPF or DMARC failure is a serious signal, because those domains publish strict policies.
Other tools
Don't miss the next analysis