Email Header Analyzer
Read the delivery path, the authentication results and — the part that decides whether a message is a forgery — whether any of it aligns with the address the reader sees. Nothing leaves your browser.
Why an SPF pass does not mean the sender is real
SPF authenticates the envelope sender — the address used during the SMTP conversation, which nobody sees. The address your mail client displays is the From header, and it is a completely separate field that SPF never looks at.
So a message can come from a server legitimately authorised for bounces.some-service.net, pass SPF, and still show ceo@yourcompany.com to the reader. That is not an edge case; it is the standard mechanism behind business email compromise.
DMARC exists to close that gap. It passes only when the From domain aligns with the SPF domain or with the DKIM d=. That is why this tool shows the three domains side by side instead of three green ticks.
Where to find the headers
- Gmail — open the message, ⋮ menu, Show original
- Outlook (new) and Outlook on the web — right-click the message, Advanced actions, View message source
- Outlook classic for Windows — open the message, File, Properties, Internet headers
- Apple Mail — View, Message, All Headers
- Thunderbird — View, Message Source
Headers are evidence, but only some of them
Only the headers added by your own mail infrastructure are trustworthy. Everything below your first trusted hop was written by someone else, and a sender can fabricate as many Received lines as they want — including a convincing Authentication-Results claiming everything passed. Always check which host wrote that line before believing it.