About this tool
Every server that handles an e-mail adds a Received: line to the top of its headers, and your mail provider adds an Authentication-Results: line with the SPF, DKIM and DMARC outcome. Read together, they show the path the message took.
To get the headers: in Gmail choose ⋮ → Show original; in Outlook on the web … → View → View message source; in Outlook desktop File → Properties → Internet headers; in Apple Mail View → Message → All Headers.
How to read the results
The timeline is shown from the first server to your inbox (the reverse of the order in the headers). Delays show how long the message waited between hops; small negative values usually mean a server clock is off.
The authentication summary uses the top-most Authentication-Results header, because that one was added by your own provider. Lower Received and Authentication-Results headers were written by earlier servers — including, possibly, the sender — and cannot be fully trusted.
Findings are worded cautiously on purpose: many signs of phishing (a different Reply-To, a failed SPF check) also occur in legitimate mail. Treat them as reasons to look closer, not as verdicts.
Limitations
- The analyzer reads what the headers say; it does not re-verify DKIM signatures or re-run SPF, because that needs the message body and the DNS state at the time of delivery.
- Servers write Received lines in slightly different formats. Unusual formats may be shown partly unparsed.
- Anything below the first Received header added by your provider can be forged by the sender.
Frequently asked questions
Is it safe to paste my headers here?
The headers are sent over HTTPS, processed in memory to build the page and then discarded. They are not saved to a database, log file or cache. Still, only paste headers you are allowed to share, and consider removing addresses you do not need analysed.
How can I tell if an e-mail is phishing?
Check that DMARC passed for the domain in the From address, that the Reply-To goes to the same organisation, and that links point where they claim. A DMARC pass means the domain is genuine — but attackers also register look-alike domains, so read the domain carefully.
Why does SPF fail on a legitimate message?
Forwarding and mailing lists resend the message from their own servers, which are not in the original sender's SPF record. DKIM normally survives, so DMARC can still pass.
What does ARC mean in the headers?
ARC (Authenticated Received Chain, RFC 8617) lets intermediaries such as mailing lists record the authentication results they saw before modifying a message, so the final receiver can take them into account.
Are my headers stored?
No. They are processed in memory and discarded.
Which header shows the real sender?
The Received headers added by your provider and the DMARC result.
Can headers be faked?
Yes, except those added by your own mail provider.