Tools / Email Header Analyzer
Email Header Analyzer
Paste the raw headers of a suspicious email, or drop the .eml file. You get SPF, DKIM and DMARC results, the full delivery path, the originating IP and the red flags of spoofing and business email compromise, with a plain-language verdict.
● Runs in your browser. Headers and .eml files never leave your device.Raw headers
Result
Paste headers and press Analyze.
Delivery path
Oldest hop firstMessage details
How to read the result
DMARC is the one that matters
DMARC pass means the visible From domain really sent it. DMARC fail on a known brand is the strongest single spoofing signal.
Reply-To mismatch
A Reply-To pointing at a different domain from the From address is the classic business email compromise setup: replies go to the attacker.
Originating IP
The first public IP in the path is usually the sender. Check it with IOC Triage or your threat-intel tools before blocking.
Fix your own domain's email security
Check a domain
Use the SPF / DKIM / DMARC Checker to see whether attackers could spoof your domain today.