Email Header Analyzer

Every email carries a stack of headers that record how it was routed and whether it passed authentication. When you are investigating a suspected phishing message, those headers are the ground truth. Paste the raw headers and this analyzer reconstructs the delivery path, extracts SPF/DKIM/DMARC results, and flags the mismatches that commonly indicate spoofing.

Reading the hop path. Each mail server that handles a message prepends a Received: header, so the list is newest-first. The tool reverses them to show the true origin first and walks forward through each from/by handoff with timestamps. A message that claims to be from a bank but originates from an unrelated consumer mail host is an immediate red flag; large gaps between hop timestamps can indicate spooling or manipulation. Bear in mind that only the hops added by servers you trust are trustworthy — an attacker can forge Received: lines below the first trusted hop, so read the chain from your own infrastructure outward and treat everything past the earliest server you control as attacker-influenced.

Authentication results. Authentication-Results records the receiving server's verdicts. SPF checks that the sending IP is authorized for the envelope domain; DKIM verifies a cryptographic signature over the message; DMARC ties them together and tells receivers what to do on failure. The tool surfaces each verdict and warns on fail/softfail/none.

Spoofing indicators. It compares the From domain against the Return-Path (a mismatch can mean spoofing or just a mailing list) and flags a Reply-To that differs from From — a hallmark of business-email-compromise, where replies are silently redirected to the attacker.

Common mistake. Trusting the friendly From display name. The display name is attacker-controlled free text; authentication binds to the domain, not the name. Always judge legitimacy by DMARC alignment and the hop path, not by what the sender calls themselves.

Defensive angle. For your own domains, publish SPF, DKIM, and an enforcing DMARC (p=reject) so receivers can reject forgeries outright — that is what turns these header checks green. The DNS record explainer shows how to read and harden those exact records. For inbound defense, alert on Reply-To/From mismatches and authentication failures, and train users that a convincing display name proves nothing. When a hop reveals an unfamiliar sending IP, the IP address info tool tells you whether it is even plausible for the claimed sender.