🔍 Email Header Forensics
Analyze email headers for delivery path, SPF/DKIM/DMARC checks, and spoofing detection
About this tool
Email headers contain a wealth of forensic information: the full delivery path through every server that handled the message, authentication results from SPF, DKIM, and DMARC checks, and metadata the sender claimed. This tool parses raw headers — copy them from Gmail (Show Original), Outlook (View Message Source), or any email client — and visualises the delivery chain, verifies authentication, and flags potential spoofing indicators.
Example: paste the headers of a suspicious invoice email. The delivery map shows it actually originated from mail.sketchy-server.xyz even though the From says payments@yourbank.com. The SPF check shows fail because sketchy-server.xyz is not authorised to send for yourbank.com, and DMARC also fails — confirming a phishing attempt.
Use this tool to investigate phishing emails, verify the authenticity of messages from your bank or HR department, or understand how email infrastructure routes messages across the internet.
FAQ
How do I get raw email headers from Gmail? ›
Open the email, click the three-dot menu in the top-right corner, and select "Show original". Copy the entire page — it includes the raw headers and body. Our tool ignores the body and only parses the header section.
What do SPF, DKIM, and DMARC actually check? ›
<strong>SPF</strong> verifies the sending server's IP is authorised by the domain in the Return-Path. <strong>DKIM</strong> checks a cryptographic signature to ensure the message wasn't tampered with. <strong>DMARC</strong> ties them together by requiring that the From domain aligns with either SPF or DKIM — preventing domain spoofing.
Why does the delivery map show hops in reverse order? ›
Each server that handles an email prepends a new Received header on top. The tool sorts them chronologically (oldest first → newest last) so you can follow the message from its origin to its final destination, top to bottom.
Can I detect all phishing emails with this tool? ›
This tool flags clear security failures (SPF fail, DKIM fail, DMARC fail) and domain mismatches, but sophisticated phishing emails can pass all checks if the attacker controls a compromised domain or uses a lookalike domain. Always combine header analysis with other signals like unexpected attachments, urgency, and sender context.