Email Header Analyser.

Paste the headers of a suspicious email. See where it really came from.

Runs in your browser. Nothing you paste is uploaded or stored.

Analyse headers How to get the headers

Analyser

Follow the email, hop by hop.

Hops in order, sender checks, and SPF, DKIM and DMARC results in plain words.

Full email headers

Headers can show your address and the addresses of others. This page never sends them anywhere. The example uses made-up domains.

Getting the headers

Where to find them.

Gmail

Show original.

Open the email, choose the three dots, then "Show original". Copy everything at the top, down to the first blank line.

Outlook

Message source.

Open the email, then File, Properties. Copy the "Internet headers" box. On the web, use the three dots, View, then "View message details".

Apple Mail

All headers.

Open the email, then View, Message, "All Headers" or "Raw Source". Copy the block at the top.

A pass is not proof of safety.Attackers can register a lookalike domain, set up SPF and DKIM correctly, and pass every check. Read the sender and the links too.

A mismatch is a clue, not a verdict.Mailing services legitimately send on behalf of companies, so a different return-path is common. Look at the whole picture.

Headers can be forged.Only the hops added by servers you trust can be believed. Lines added by the sender can say anything.

Free live toolJWT decoder Free toolPhishCheck MCP LessonEncoding, Encryption & Hashing

More free tools.

Lessons, tools and datasheets. No sign-up.

Back to Free See the courses