See the real delivery path and spoofing verdicts
Email Header Analyzer
Runs entirely in your browser — nothing you type here is sent to our servers.
In Gmail: open the email → ⋮ menu → "Show original". In Outlook: File → Properties → Internet headers.
How to read this
Each Received header is added by a mail server as the message passes through it — reading them in order shows the real path an email took, which is much harder to fake convincingly than the Fromname shown in an inbox. A "pass" on SPF, DKIM, and DMARC means the receiving server verified the message actually came from a server authorized by the sending domain — the strongest signal that an email isn't spoofed.
Frequently asked questions
Where do I find raw email headers?+
In Gmail: open the email, click the ⋮ (more) menu, and choose "Show original". In Outlook: File → Properties → Internet headers. In Apple Mail: View → Message → All Headers. Copy everything and paste it here.
If SPF and DKIM both show "pass", is the email definitely safe?+
It means the message wasn't spoofed at the technical/domain level — but a compromised legitimate account, or a malicious domain that correctly configured its own SPF/DKIM, will still pass. Authentication verifies the sending domain, not the sender's intent or trustworthiness.
What does a missing DMARC result usually mean?+
Either the sending domain hasn't published a DMARC policy, or the receiving server didn't evaluate one. A domain with no DMARC policy has no instruction telling receiving servers what to do with mail that fails SPF/DKIM — making that domain easier to spoof.
Can the delivery path itself be faked?+
Each server in the chain adds its own Received header when it receives the message, and can't rewrite headers added by servers before it in the same way a display name can be faked — but a header a spoofer's own first server writes can still be arbitrary. Focus on hops after the message leaves a domain you don't control, and cross-check against SPF/DKIM/DMARC results rather than the path alone.
Is any of this sent to your servers?+
No. Parsing happens entirely in your browser with JavaScript — the headers you paste are never transmitted anywhere, which matters since headers can contain internal server names and IP addresses.