Email Header Analyzer
Paste raw email headers and get flagged for From/Return-Path mismatches, SPF failures, and missing DKIM.
The From address in an email is decoration — it is typed by whoever sent the message. What actually establishes origin is the header chain: the Received lines recording each hop, and the SPF, DKIM and DMARC results recording whether the sending domain authorised it.
How to use it
- Paste raw email headers.
- Read the parsed hops and authentication results.
- Compare the visible From against the envelope sender and the authenticated domain.
What to take away
Read Received headers bottom-up
The oldest hop is at the bottom. Everything above it was added later — and anything below the first server you trust could have been forged by the sender.
SPF, DKIM and DMARC answer different questions
SPF asks whether that server was allowed to send for the domain. DKIM asks whether the message was signed and unaltered. DMARC ties either result to the From address the human actually sees, which is the only one that matters for phishing.
Display name spoofing beats all three
A message from a genuine Gmail account with the display name "IT Helpdesk" passes every check, because nothing about it is technically forged. This is why most real phishing does not bother with spoofing at all.
Frequently asked questions
How can I tell if an email was spoofed?
Check whether DMARC passed and whether it aligned with the visible From domain. SPF or DKIM passing for some other domain is exactly what a spoofed message looks like.
Where do I find the raw headers?
In Gmail, "Show original". In Outlook, "View message source" or message properties. Most clients hide it deliberately, because it is noise to almost everyone.
Does a passing SPF mean the email is safe?
No. It means the sending server was authorised by some domain. Attackers register their own domains and pass SPF perfectly — authentication proves origin, never intent.
Where this fits in the course
This security tool pairs with Path 09 — Digital Privacy — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Phishing Spotter — Real email or phish? Call each one, then see the exact red flags you spotted (or missed). Trains the instinct that stops most attacks.
- User-Agent String Parser — Break down a User-Agent string into OS, browser, and version — and flag common automated-client patterns.
- Log Grep / Filter Playground — Filter a block of log lines with a regex — the exact "find the signal in the noise" skill IR work depends on.
- Security Header Analyzer — Paste HTTP response headers and get a graded report on the security headers present and missing.