[ Trace delivery path | SPF/DKIM/DMARC | Detect spoofing | Runs in browser ]
// All processing happens locally in your browser. Headers are never sent to our servers.
Gmail: Open email → click ⋮ (three dots) → "Show original" → "Copy to clipboard"
Outlook Web: Open email → click ⋯ → "View message source" → copy all text
Apple Mail: View menu → Message → All Headers — then select all text
Thunderbird: View → Headers → All — or press Ctrl+U for full source
The originating IP is the address of the mail server or device that first submitted the email into the delivery chain. In legitimate email, this is typically your email provider's outgoing mail server. For spoofed or phishing email, you may see a suspicious IP that doesn't match the sender's claimed domain. Cross-reference the originating IP against the domain's SPF record — if the IP is not listed, the email was sent from an unauthorised server.
SPF softfail (~all) means the sending IP is not listed in the domain's SPF record, but the domain owner used a lenient policy that says "accept but mark it." This is weaker than hardfail (-all) which tells receivers to reject the message outright. A softfail may indicate: a legitimate but misconfigured mail server (e.g., a forgotten mail relay), a forwarded email, or a spoofed message. Email receivers typically accept softfails but may apply a spam score penalty.
Yes — the From:, Reply-To:, and even some Received: headers can be forged by a sender. The most reliable headers are those added by your receiving mail server (your inbox provider), which appear at the top of the Received chain. These cannot be forged because they are written by a server you trust. DKIM signatures also provide cryptographic verification of the sending domain — if DKIM passes, the email content and From domain are authentic.
DKIM (DomainKeys Identified Mail) is a cryptographic authentication method. The sending mail server signs the email with a private key, and the receiving server verifies the signature using a public key published in the sender's DNS records. A DKIM pass means the email content and the From domain have not been tampered with in transit. A DKIM fail or missing signature doesn't always mean phishing, but combined with SPF failures and suspicious originating IPs, it strongly suggests spoofing.
Each Received: header includes a timestamp. The difference between consecutive timestamps is the delay at that hop. A 1–5 second delay is normal server processing. Delays of minutes or hours at a specific hop usually indicate: a greylisting policy (deliberate delay for unknown senders), a congested or overloaded mail server, DNS lookup failures, or deliberate throttling by a spam filter. Unusually high delays early in the chain (at the sender's server) can indicate a misconfigured or low-reputation sending server.
Gmail: Open the email, click the three-dot menu (⋮), select "Show original" — copy the full source. Outlook (web): Open the email, click the three-dot menu, select "View > View message source". Outlook (desktop): Open the email, go to File > Properties — the headers appear in the "Internet headers" box. Apple Mail: Open the email, go to View > Message > All Headers. Thunderbird: View > Headers > All, or press Ctrl+U for full source.
Every email you receive contains a set of metadata lines called headers. While the email body is what you see in your inbox, headers record the complete technical story of how the message traveled from the sender's device to your inbox — including every mail server it passed through, timestamps, authentication checks, and information about the sender's mail software.
Headers are written in reverse chronological order: the most recent hop (your inbox server) is at the top, and the oldest hop (the sender's mail server) is at the bottom. This can be confusing at first, but it's the standard format across all email systems.
Each mail server that handles your email adds a "Received" header. By reading them from bottom to top, you can trace the exact path the email took. Each Received header contains:
The time difference between consecutive Received headers tells you how long each server took to process the email. Delays over 5 minutes may indicate spam filtering, greylisting, or a congested server.
These three fields often confuse users — they serve distinct purposes:
A globally unique identifier assigned by the sending mail server. Format: <random-string@sending-domain.com>. The domain in the Message-ID should match the sending domain. A mismatch is a minor red flag, though not definitive proof of spoofing.
SPF lets a domain specify which IP addresses are authorised to send email on its behalf. The receiving server looks up the sender domain's SPF DNS record and checks whether the sending server IP is listed.
DKIM adds a cryptographic signature to the email. The sending server signs the email with a private key; the receiving server retrieves the public key from the sender's DNS and verifies the signature. A valid DKIM signature proves the email body and headers haven't been tampered with in transit.
DMARC builds on top of SPF and DKIM. It tells receiving servers what to do when SPF and/or DKIM fail (none/quarantine/reject) and provides a mechanism for the sending domain to receive abuse reports. DMARC also enforces "alignment" — the From domain must match the SPF/DKIM signing domain.
Email header analysis is one of the most reliable ways to detect phishing. Look for these red flags: