Free tool

Analyze a received email

The display name says “PayPal”, but who really sent this message? Paste its headers (or the full message): we read what your email software hides from you.

Where to find the headers?
Gmail (web)
Open the message → the ⋮ menu (More) next to Reply → Show original → Copy to clipboard. Or Download original to get the .eml file.
Outlook on the web, Outlook.com, new Outlook
Open the message → … (More actions) → View → View message details, then select all and copy. To get the whole message: … → Download (.eml).
Outlook (classic desktop)
Double-click the message to open it in its own window → File → Properties → Internet headers box: click inside, Ctrl+A, Ctrl+C.
Apple Mail
Select the message → View → Message → All Headers (⇧⌘H), or Raw Source (⌥⌘U) for everything. File → Save As… “Raw Message Source” gives an .eml file.
Thunderbird
Open the message → More → View Source (Ctrl+U), then select all and copy. Or File → Save As → File (.eml).
On a phone
Mobile apps generally do not show headers. Open the message on a computer, or forward it to yourself as an attachment.

🔒 Everything is analyzed in your browser: neither the headers nor the message are sent to our server. No link is visited, no image is loaded.

What headers are

Every email carries a hidden part, the headers: a kind of travel log written by each server the message went through.

Your email software shows you three lines of it (name, subject, date). The rest says where the message really comes from, whether the sending domain vouched for it, and whether anyone tampered with it. Fraudsters can fake the display name and the first lines; they cannot fake what your own provider adds at the top.

The three checks

SPF

Allowed server?

The domain publishes the list of servers allowed to send for it. Checks the technical envelope address (Return-Path), not the one you see.

Often breaks when a message is forwarded.

DKIM

Signed and intact?

A cryptographic signature added by the sender. If the message was altered on the way, it fails.

The d= tells you which domain signed.

DMARC

Is the “From” genuine?

Checks that the domain you see in “From” matches the one validated by SPF or DKIM.

A DMARC pass does not mean the domain is honest: paypal-support.help can pass DMARC perfectly.

The signs that matter most

  1. A display name that does not match the address“Desjardins” writing from a gmail.com address, or a name that contains another email address.
  2. A domain that imitates a brandAn extra word (interac-depot.help), a swapped letter, a Cyrillic character. See our lookalike characters tool.
  3. Replies that go elsewhereA Reply-To on a free address: your answer will reach the fraudster, not the company.
  4. Links whose text liesThe link shows the company's address but leads to another domain.

No single sign is proof, and a message can pass every check and still be fraudulent: a hacked account sends perfectly authenticated email. When in doubt, contact the sender another way (phone number you already have, site typed by hand).

And if it is your domain being spoofed?

If someone sends messages in your organization's name, a DMARC policy set to quarantine or reject keeps them out of inboxes. Check your configuration with our SPF, DKIM & DMARC checker, then read the reports with the DMARC report reader.