Browse tools

Email Header Analyser

Is that email really from who it says? Paste its headers to see the servers it passed through and where it started, whether it passed SPF, DKIM and DMARC, what Microsoft 365 or other spam filters thought of it, and the warning signs of a spoofed or hijacked sender.

Paste the email headers

How to find an email's headers
  • Outlook (new and web): open the email, select the three dots (…) at the top right of the message, then View > View message source (or View message details).
  • Outlook (classic desktop): open the email in its own window, then File > Properties, and copy the "Internet headers" box.
  • Gmail: open the email, select the three dots (⋮) next to Reply, then Show original. Copy everything, or use Download original and open the .eml file here.
  • Apple Mail: View > Message > All Headers (or Raw Source).
  • Thunderbird: View > Message Source (Ctrl+U).

What the results mean

  • SPF checks the sending server is allowed to send for the domain in the hidden "envelope" address. DKIM checks a digital signature added by the sender's domain. DMARC checks that at least one of them passed for the domain shown in the From line.
  • Delivery path: each mail server adds a "Received" line on top, so we read them from the bottom up. Long delays usually mean spam filtering, greylisting or a queue.
  • Origin: the earliest public address is usually the sender's mail server or device. Lines added before your own provider's servers can be faked by the sender, so trust the ones your provider added.

Warning signs of a scam

  • DMARC fails, or SPF and DKIM both fail, for a well-known company.
  • Reply-To differs from From: replies go to the scammer, a classic invoice-fraud trick.
  • A display name that pretends to be someone else, such as "Microsoft 365 <alerts@random-site.com>".
  • Everything passes, but the request is odd? The sender's real account may have been hacked. Phone them on a number you already know before paying or changing bank details.

Privacy: the headers are analysed in your browser. Only the public IP addresses found in them are sent to our server, to look up who owns them; untick the box to skip that.

More free tools