Email header analyser
Every server a message passes through writes a line on top of it. Paste the headers to read them in order: where it came from, where it waited, and whether the receiving server believed who it claimed to be from.
Se ejecuta por completo en tu navegador: no se envía nada a ningún sitio
Reading the route
The first hop is where the message entered the mail system — often the sender’s own mail server or service, and its address is the closest thing to the sender’s location that email records. Each later hop is a server passing it on, and the last is your provider delivering it to your mailbox.
Spotting a phishing message
- DMARC failed on a message claiming to be from a bank or a large company: it is almost certainly forged.
- Reply-To points somewhere else, so your answer goes to the attacker rather than to the name you saw.
- A lookalike domain passes everything — rn instead of m, an extra word, a different ending. Authentication proves the domain, not that it is the one you know.
To check a domain’s own records, use the SPF, DKIM and DMARC check. Why your email goes to spam covers the sending side.
Where do I find the headers?
Gmail: open the message, then ⋮ → Show original. Outlook on the web: ⋯ → View → View message source. Outlook for Windows: File → Properties, under “Internet headers”. Apple Mail: View → Message → All Headers. Other services usually call it “show original” or “view source”.
Which lines can I trust?
Each server adds its line on top, so the lines your own provider added are at the top and are reliable. Everything below them came with the message, and a sender can put anything there — including fake earlier hops.
Why was a message delayed?
Look for the hop with the long wait: the server that wrote the next line is where it sat. Common causes are a busy queue, spam or virus scanning, and greylisting, where a server deliberately rejects a first attempt and waits for the retry.
Does “pass” mean the message is safe?
No. It means the message came from the domain it claims. Attackers register their own domains and pass every check; what matters is whether that domain is who you think it is.
Is it safe to paste headers here?
They never leave your browser. Headers do contain names, addresses and sometimes internal server names, so mask them before posting headers anywhere public.