Email header analyzer
Paste the full headers of a suspicious email to see who really sent it, how it travelled and what doesn't add up.
Runs in your browser. Nothing is sent unless you choose Check reputation, and nothing is stored.
What it checks
SPF, DKIM and DMARC results from Authentication-Results, and whether the signing and bounce domains line up with the From address. The Received hops in order, with the delay at each step.
Red flags in plain English: replies going to a different address, a display name showing another address, failed or missing authentication, and hop times that go backwards.
How to get the headers
Gmail: open the message, then More (⋮) → Show original. Outlook: open the message, then File → Properties → Internet headers (desktop) or ⋯ → View → View message source (web). Apple Mail: View → Message → All Headers.
Headers stay on your device
Decoding happens in your browser. What you paste isn't sent to our server or anyone else, so it's safe to use with tokens and emails from real incidents.