Free Tools/Email Header Analyzer
Is that email really from who it says?
Every email carries hidden routing and authentication details that your mail app doesn't show. Paste them below and we'll decode where the message actually came from and whether it passed the checks that catch impersonators.
How do I find an email's headers?
- Gmail
- Open the message, click the three dots in the top-right corner, choose "Show original", then copy everything on that page.
- Outlook (web)
- Open the message, click the three dots in the message toolbar, choose View, then "View message details", and copy the text.
- Outlook (desktop)
- Double-click the message to open it in its own window, then go to File, Properties, and copy the "Internet headers" box.
- Apple Mail
- Open the message, then choose View, Message, "All Headers" (or "Raw Source") and copy the text.
Common questions
What are email headers?
Every email carries hidden routing information: which servers handled it, when, and whether it passed authentication checks like SPF, DKIM, and DMARC. Mail apps hide all of this by default. Headers are like the envelope and postmarks on a letter, and they often reveal a fake that looks perfect on the surface.
Is the email I paste here private?
Yes. This page analyzes the text entirely in your browser. Nothing you paste is uploaded, logged, or stored anywhere, and the analysis works even if you disconnect from the internet after loading the page.
Can headers prove who really sent an email?
They're strong evidence, not absolute proof. Authentication results (SPF, DKIM, DMARC) verified by your own mail server are reliable signals, and the chain of receiving servers is hard to fake completely. But early hops in the chain can be forged by the sender. If money or credentials are on the line, verify through a channel you already trust, like a known phone number.
The analyzer flagged a mismatch. Is the email definitely fake?
Not necessarily. Newsletters, invoicing tools, and mailing lists legitimately send "on behalf of" other domains, which produces mismatches. Treat flags as reasons to slow down and verify, especially if the email asks for payment, gift cards, credentials, or urgency. When in doubt, forward it to us and we'll take a look.
Suspicious emails hitting your team?
We set up phishing protection, staff training, and email authentication so fakes get blocked before anyone has to play detective. Start with a free assessment.