Every email carries a header with the full route the message took and the outcome of the authenticity checks. Paste the header and this tool shows the sender, the servers the message passed through and whether SPF, DKIM and DMARC passed.
What this tool does
The tool parses the pasted header, turns the Received lines into a readable route and reads the Authentication-Results for SPF, DKIM and DMARC. Everything runs locally in your browser.
How to use it
In Gmail use Show original, or in Outlook use message options, copy the full header and paste it into the field. The analysis appears immediately.
Input and output
- Input: the full text of an email header
- Output: the sender, the servers passed with timestamps and the result of SPF, DKIM and DMARC
Limitations
The result is only as reliable as the header the receiving server filled in; the tool performs no new checks itself. The header is never sent anywhere.
Good to know
The header is the most reliable source to judge a suspicious email, because sender names are easy to fake but the route is not. Watch especially the first Received line and a dmarc=fail in the Authentication-Results.