Email header analyzer

Paste the full headers from a suspicious message. This reads authentication results, the delivery route, and the identity fields — without sending the message anywhere.

In Gmail: open the message, “Show original”. In Outlook: File → Properties → Internet headers.

How to read this

• Authentication-Results are claims by the receiving server. They are only as trustworthy as that server, and they cover the hop it saw.
• SPF checks the envelope sender (Return-Path), not the From address. A spf=pass alone says nothing about the visible sender.
• DMARC ties SPF or DKIM to the From domain with alignment. Prefer dmarc=pass when judging the From header.
• Received headers are added by each server, newest on top. The bottom-most public address is usually the origin — unless a relay forged it.
• Mailing lists and forwarders legitimately break Return-Path alignment. A mismatch is a lead, not a verdict.