Paste the full headers of a suspicious email and see its routing chain, authentication results and red flags — analysed locally, nothing sent anywhere.
Where do I find the headers?+
Gmail (web) Open the email → ⋮ menu (top right of the message) → Show original → copy everything.
Outlook (web) Open the email → ⋮ → View → View message source.
Outlook (desktop) Double-click the email to open it → File → Properties → copy the Internet headers box.
Apple Mail Select the email → View → Message → All Headers (or Raw Source).
Yahoo Mail Open the email → ⋯ → View raw message.
iPhone / Android apps Most mail apps can't show full headers — open the account in a desktop browser instead, or forward the email to yourself as an attachment.
TIP: copy the whole block from the top — it must include the Received: lines. Forwarding an email normally strips the original headers.
PASTE RAW EMAIL HEADERS (SEE “WHERE DO I FIND THE HEADERS?” ABOVE)
How to Read the Result
Each Received: line is a server stamping the message as it passed through — read from the bottom up, the first hop is closest to the true origin. SPF, DKIM and DMARC are the receiving server's own verdict on whether the message really came from the domain it claims. A failed or missing verdict, a Reply-To that differs from the sender, or a Return-Path pointing at an unrelated domain are the classic signs of spoofing — the pattern behind most business email compromise.
This tool gives an indication, not a finding. Headers can themselves be forged below the first trusted hop, and a proper attribution exercise corroborates them against server logs — the kind of work we do formally in a Forensic Examination.
Free awareness tool — everything runs locally in your browser; nothing is uploaded, stored or logged. Headers are parsed locally by your browser. For forensic-grade work on a live matter, Contact Us in Confidence.
Facing Something That Needs a Forensic Examiner?
A certified examiner responds within one business day — in confidence, no obligation.
Free tools are for triage. When the result matters in a legal proceeding, it needs defensible methodology and a certified examiner. Confidential, no obligation.