Gmail: open the message → three-dot menu → Show original. Outlook: File → Properties → Internet headers. Apple Mail: View → Message → All Headers.
Email Header Analyzer — Check SPF, DKIM and DMARC to Spot a Phishing Email
Every email carries a hidden delivery record. Read it properly and you can tell within seconds whether a message genuinely came from the domain it claims. This free email header analyzer parses SPF, DKIM and DMARC results, compares the visible sender against the envelope sender, maps the delivery path hop by hop, and flags the specific mismatches that phishing relies on. It runs entirely in your browser — headers are never uploaded.
The three checks that matter
| Check | What it proves | What a failure means |
|---|---|---|
| SPF | The sending server's IP is authorised by the envelope domain | Mail was sent from a server the domain owner never approved |
| DKIM | The message carries a valid cryptographic signature | Content was altered in transit, or the signature is forged |
| DMARC | The visible From domain aligns with the authenticated domain | Someone is displaying a sender address they do not control — the definition of spoofing |
DMARC is the one to read first. SPF and DKIM validate the envelope, which the recipient never sees. Only DMARC ties authentication back to the From address displayed in the mail client, which is the address the person reading it will actually trust.
How to get the raw headers
- Gmail: open the message, click the three-dot menu, choose Show original, then copy the text block.
- Outlook desktop: open the message, then File → Properties and copy the Internet headers box.
- Outlook on the web: three-dot menu → View → View message details.
- Apple Mail: View → Message → All Headers, or press Shift+Command+H.
- Thunderbird: View → Headers → All, or Ctrl+U for the full source.
Mismatches worth acting on
Authentication passing is not the whole story. A well-resourced attacker can register a domain, configure SPF and DKIM correctly for it, and pass every check — while still impersonating a brand in the display name. The analyzer therefore also compares the fields that catch this:
- Reply-To on a different domain. The most common phishing tell. The message appears to come from a trusted sender, but replies route to an address the attacker controls.
- Return-Path mismatch. Normal for legitimate bulk senders and mailing lists, suspicious when combined with a DMARC failure.
- Message-ID from an unrelated host. Genuine mail from a large provider almost always carries a Message-ID generated by that provider.
- Homoglyph domains. Cyrillic and Greek characters that render almost identically to Latin letters are used to register convincing lookalike domains.
- Display-name spoofing. The name shown in your inbox is free text. Always read the actual address, not the label.
Reading the delivery path
Received headers are written by each server that handles the message and are stacked newest-first in the raw source. The analyzer reverses them into chronological order and calculates the gap between hops. Delays of several minutes usually indicate greylisting or a queue backlog rather than anything malicious, but an unexpected relay in an unrelated country early in the chain is worth investigating.
Frequently asked questions
How can I tell if an email is spoofed?
Check DMARC first. If DMARC fails, the visible From address does not belong to whoever actually sent the message, which is spoofing by definition. Then compare the Reply-To and Return-Path domains against the From domain, since attackers who pass authentication on their own domain still have to redirect replies somewhere.
What does SPF softfail mean?
Softfail means the domain owner has published a policy indicating the sending server is probably not authorised, but has asked receivers not to reject the message outright. It is a warning rather than a verdict, and should be treated as suspicious when combined with any other mismatch.
Can a phishing email pass SPF and DKIM?
Yes. An attacker who registers their own domain can configure both correctly and pass them. That is precisely why DMARC alignment matters: it checks the authenticated domain against the address you actually see in your mail client.
Is it safe to paste email headers into an online tool?
With this one, yes, because nothing leaves your device. The analysis is performed by JavaScript in your browser and no header data is sent to any server. Be cautious with tools that do not state this, since headers can contain internal hostnames and IP addresses.
What is the difference between SPF, DKIM and DMARC?
SPF authorises which servers may send for a domain. DKIM cryptographically signs the message so tampering is detectable. DMARC ties both back to the visible From address and tells receivers what to do when they fail. All three are needed; DMARC is what makes the other two meaningful to the recipient.
Related tools: Password Strength Analyzer, Password Generator, and QR Code Generator. For email security platforms worth paying for, read our honest reviews.