How it works
Every email carries a block of headers that records where it came from and how each server judged it. For a reported phishing email they answer the key questions: did it really come from the domain it claims, which server sent it, and where should a reply go?
Paste the raw headers and the analyzer unfolds them, decodes encoded subjects, and lays out the delivery route hop by hop with the time each step took. It reads the receiving server’s SPF, DKIM and DMARC verdicts and picks out the originating IP address. It also flags the signs analysts look for: a Reply-To on a different domain, a display name that shows a different address from the real sender, failed authentication, and delays or times that do not add up.
Header values are written by whoever sent the message, so treat everything below your own organisation’s first server as a claim, not proof.
Questions
How do I get the full headers of an email?
In Gmail, open the message, choose the ⋮ menu and “Show original”. In Outlook on the web, choose ⋯, then View, then “View message source”. In Outlook for Windows, open the message, choose File, then Properties, and copy the “Internet headers” box. In Apple Mail, choose View, then Message, then “All Headers”. Copy everything from the first line down to the start of the message body.
What do SPF, DKIM and DMARC results mean?
SPF checks whether the sending server is allowed to send email for the domain. DKIM checks a cryptographic signature added by the sending domain. DMARC checks that the domain in the visible From address lines up with SPF or DKIM, and tells receivers what to do when it does not. A DMARC fail on a message that claims to come from a well-known brand is a strong sign of spoofing.
Which IP address is the real sender?
Each server that handles a message adds a Received header at the top, so the oldest hop is at the bottom. The tool reads them in delivery order and reports the first public IP address, which is usually the sender’s mail server or device. Private addresses (10.x, 192.168.x and so on) are skipped. Headers above your own organisation’s first server are added by your systems; anything below it could in principle have been written by the sender.
Is it safe to paste headers from a confidential email?
Yes. The analysis runs entirely in your browser: nothing is uploaded, stored or logged, and the page cannot send what you paste anywhere. Headers can contain internal server names and addresses, which is exactly why this matters.