How to analyse email headers
- Open the full headers of the email. In Gmail choose ⋮ → Show original; in Outlook open the message, then File → Properties → Internet headers; in Apple Mail use View → Message → All Headers.
- Copy everything and paste it here, then press Analyse.
- Read the summary first: SPF, DKIM and DMARC results, and warnings about mismatched sender, return and reply addresses. Then follow the delivery path hop by hop to see which servers handled the message and where it was delayed.
Spotting spoofed and phishing emails
The From line in an email is easy to fake, but the headers record what actually happened. SPF checks that the sending server is allowed to send for the envelope domain, DKIM verifies a cryptographic signature added by the sending domain, and DMARC ties both to the visible From address. A DMARC fail on a message claiming to be from your bank is a strong sign of spoofing. Look also for a Reply-To on a different domain (replies go to the scammer), look-alike domains such as "paypa1" instead of "paypal", and Received lines from unexpected countries or home connections.
The delivery path also helps with legitimate problems: finding where a message was delayed, which server rejected it, or whether a newsletter service is sending on your behalf correctly. Headers are read from the bottom up, so the tool reverses them to show the first hop first. Times come from each server's clock, so small negative delays are just clock differences. Everything runs in your browser; headers often contain your address and IP information, so they are not uploaded.
What does "SPF softfail" mean?
The sending server is not clearly authorised by the domain's SPF record. Combined with a DMARC fail, the message is probably not from who it claims.
Can headers show the sender's real IP address?
Sometimes. The first external Received line usually shows the sending server's IP; big webmail providers often hide the user's own IP.
Is a passing DMARC a guarantee of safety?
No. It proves the domain sent it, but scammers can register look-alike domains that pass all checks. Read the domain carefully.