What to look for in an email header
- Authentication-Results: the receiving server's SPF, DKIM and DMARC verdicts. A message with
spf=failordmarc=failmay not come from the domain it claims to. - Received lines: every server the message passes through adds one. The bottom line is the first server, so read from the bottom up when looking for the real source.
- From vs. Return-Path: if the visible sender and the bounce address use different domains and DMARC also fails, it may be a phishing sign.
- Reply-To: replies going to a different address than the sender is a classic technique in CEO fraud (business email compromise, BEC) attacks.
- Delays: a long gap between two Received lines points to the server that held up the message.
If your own domain has no DMARC record, attackers can send the same kind of messages in your name. Check your SPF, DKIM and DMARC records, and read what a spam filter does about the rest.
Frequently asked questions
What is an email header?
The header is the block of technical information that comes before an email's body and is normally hidden. It records which servers the message passed through, the sending server's real address and IP, SPF/DKIM/DMARC results and timestamps. The display name in the From field is easy to fake; the server chain in the header is much harder to forge.
What do SPF, DKIM and DMARC "pass" or "fail" mean?
pass: the check succeeded, so the message really came from a server authorized to send for that domain. fail: the check failed, so the message may be forged. none/neutral: the domain doesn't publish that record, so no check was possible. Be careful if all three are "fail" or "none", but that alone isn't proof of phishing; some legitimate senders leave their records incomplete.
Why are the Received lines in reverse order?
Each server adds its own "Received:" line to the top as it passes the message on. So in the raw header the top Received line is the last server that delivered to you, and the bottom one is the first server the message left from. This tool puts them in chronological order for you.
Is it bad if From and Return-Path are different?
Not by itself. Newsletters, CRMs and many legitimate bulk email services do this. But if a suspicious message also fails SPF/DKIM/DMARC, the chance of spoofing goes up. This tool weighs both together and shows a warning, not a verdict.
Where does the header I paste go?
Nowhere. This page doesn't send the header to our servers; it parses it with JavaScript in your browser's memory. When you close the page, the data is gone. Nothing is stored.
How do I find the sender's IP address in a header?
The IP in the lowest Received line that doesn't belong to your own mail system is where the message entered the internet. You can check that IP with our email blacklist check.
Can an email pass SPF and still be fake?
Yes. SPF checks the Return-Path domain, not the visible From address. An attacker can pass SPF on their own domain and put a different domain in the From field. That's why you need to look at the DMARC result.
Related: SPF, DKIM and DMARC explained · SMTP error codes · All free tools