Email Header Analyzer (SPF, DKIM, DMARC)
Quick answer: open the email → Show original / View headers → copy all → paste below. Look at SPF, DKIM and DMARC first. Fail usually means do not trust the From name.
🔒 Headers are parsed only inside your browser. We do not send or save them.
Important: this reads the text you paste. It does not contact DNS or the sending server. Treat it as a guide.
Try an example:
How to read email headers
Why
Phishing mails copy a bank or brand name in the From line. Headers show who really sent it.
What
You paste the raw headers. The tool reads Authentication-Results (SPF, DKIM, DMARC), compares Return-Path with From, and lists Received hops.
How
- Open the suspicious email.
- Choose Show original / View source / Internet headers.
- Copy everything and paste it in the box.
- Read SPF, DKIM and DMARC first. Then check Return-Path vs From.
Example, step by step
- Input: headers where From says hdfcbank.com but SPF=fail and Return-Path is evil-notify.top.
- Result: SPF fail, DKIM fail, DMARC fail, domain mismatch.
- What it means: Priya deletes the mail and opens the real HDFC app. No KYC notice there.
Ravindra Bagale's Tip
Never judge an email by the display name alone. Open "Show original", check SPF/DKIM/DMARC, and compare Return-Path with From. If they disagree, delete and open the official app.
Ravindra Bagale's Tip – मराठी
फक्त display name पाहून email वर विश्वास ठेवू नका. "Show original" उघडा, SPF/DKIM/DMARC तपासा, आणि Return-Path व From जुळतात का ते पहा. नसल्यास delete करा आणि official app उघडा.
Ravindra Bagale's Tip – हिंदी
केवल display name देखकर email पर भरोसा न करें. "Show original" खोलें, SPF/DKIM/DMARC जाँचें, और Return-Path व From मिलाएँ. नहीं मिलते तो delete करें और आधिकारिक app खोलें.
Frequently asked questions
Where do I find full headers?
Gmail: open the mail → three dots → Show original → copy all. Outlook: File → Properties → Internet headers. Apple Mail: View → Message → Raw Source.
Does this tool send my email to a server?
No. Parsing happens only in your browser. We never see the headers.
Is SPF pass enough?
No. Prefer SPF + DKIM + DMARC all pass, and matching domains. One pass with other fails is still risky.