Is my email content or password ever seen by this tool?

No. Email headers contain zero passwords, zero email body content, and zero attachments. They only contain technical routing and security information — the same information your email provider already has. Everything is processed inside your own browser; nothing is sent to any server.

What if the result says 'Review Before Trusting' instead of a clear yes/no?

Some legitimate companies use third-party services to send emails (like marketing platforms or support ticket systems), which can sometimes show partial authentication results even though the email is genuine. We show you the exact reasons and checklist so you can make an informed decision — and we recommend contacting the company directly through their official website or phone number, never by replying to the email.

Can this tool detect every kind of scam email?

This tool detects sender impersonation — when someone fakes the 'from' address to pretend to be a trusted company. It cannot detect scams where the sender's email address is genuinely theirs (like a hacked personal account) or scams that rely purely on convincing text rather than fake sender addresses. Always stay cautious with links and attachments regardless of the verdict.

Why does the result mention SPF, DKIM, or DMARC?

These are the three technical security systems we check behind the scenes. You don't need to understand them — we translate the result into plain English. But if you're curious, click 'Show Technical Details' on any result to see exactly what each system found.

Yes, completely free, no signup, no limits, and no ads collecting your data.

My result shows 'Could not read headers' — what do I do?

This usually means you copied only part of the email, or copied the email body instead of the technical header. Go back to Step 1 in the 'How To' section above and make sure you're copying from 'Show Original' or 'View Message Source' — not from the regular email view.

How do I extract raw internet email headers in Gmail, Outlook, or Apple Mail?

In Gmail: click the three vertical dots next to Reply and select 'Show original'. In Outlook Web: click More actions (...) > View > View message details. In Apple Mail: choose View > Message > Raw Source. Copy the entire header block and paste it directly into this checker.

What is DMARC alignment and why is it important?

DMARC alignment checks whether the domain in the visible 'From' header exactly matches the domain validated by SPF (in the Return-Path) and/or DKIM (in the d= signature). Even if SPF and DKIM pass individually, a lack of alignment indicates potential impersonation or display-name spoofing.

security-privacy100% Client-Side Local

Email Header Analyzer & Phishing Checker

Got an email that looks like it's from your bank, your employer, or a government office — but something feels off? Paste the email's technical details below and get a plain-English answer in seconds. No tech knowledge required.

Privacy Guarantee: Email headers are parsed and evaluated entirely inside your browser sandbox. Message contents and server hops are never transmitted or saved.

Private. Local. No uploads.

Email header

How do I get the email header? ↓

About this tool

About Email Header Analyzer & Phishing Checker

The Email Header Analyzer & Phishing Checker is a free, privacy-first cybersecurity utility created to uncover fraudulent, spoofed, or malicious emails. By analyzing the raw, cryptographic internet message headers hidden behind every email message, it verifies whether the sender is authentic or an impersonator.

Phishing, display-name spoofing, and Business Email Compromise (BEC) attacks frequently mimic recognizable brand logos, executive names, and financial institutions. However, scammers cannot forge cryptographic authentication signatures or legitimate email routing infrastructure. This tool inspects SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), DMARC (Domain-based Message Authentication, Reporting, and Conformance), sender alignment, server hops, and reply-to discrepancies.

100% Client-Side Privacy: Your sensitive email communications and security headers are processed entirely within your web browser using local JavaScript parsing. Nothing is ever uploaded to a remote server, tracked, or stored.

Under the hood, made human

What This Tool Actually Checks

Every email carries hidden technical proof of where it really came from — even if the sender's name looks legitimate. This proof lives inside something called "email headers," which most people never see.

This tool reads that hidden proof and tells you, in plain language, whether the email actually came from who it claims to be from. We check three security systems that almost every legitimate company uses:

→Did the email come from the company's real servers?

→Was the email tampered with after it was sent?

→Does the company's own security system approve of this email, or would it have blocked it?

You don't need to understand any of the technical terms. We translate everything into a simple verdict — along with the specific reasons why.

Why Checking Manually Isn't Enough

Scammers are good at making fake emails look real. They can copy a bank's logo, font, and writing style perfectly. What they CANNOT fake is the technical trail left behind by real email servers — unless they've actually broken into the company's systems.

Looking at the sender's name or email address is not enough. A scammer can make an email LOOK like it's from "support@yourbank.com" — but the hidden technical proof will reveal it actually came from a completely different, unauthorized server.

This is exactly the kind of proof banks, email providers, and security teams use internally. We're just making it readable for everyone else.

How To Use the Email Header Analyzer & Phishing Checker

Three simple steps — no technical knowledge required.

Get the email header

Open the suspicious email in your email app and copy the full header or 'original message.' Not sure how? See the provider-specific guide below.

Paste it here

Paste the copied header text into the input box at the top of this page. It will look like confusing technical code — that's completely normal.

Read your verdict

Click "Check This Email" and get an instant plain-English verdict with specific reasons explained.

How To Find Email Headers — Step by Step For Every Email Provider

The technical proof you need is hidden inside something called the "full email header" — every email service lets you view it, but the button is tucked away. Select your email provider below.

📧Gmail

1Open the email you want to check
2Click the three dots (⋮) in the top-right corner of the email
3Select "Show original"
4A new tab opens showing the full header
5Click "Copy to clipboard" or select all text manually

Note: Email provider interfaces update periodically, so menu names or button locations may shift slightly. If you can't find the exact option listed, search "[your provider] view original email source" for the latest instructions from that provider.

Frequently Asked Questions

Companion Guides & Technical Insights

All Guides

Security & PrivacyOctober 1, 2026

Is It Safe to Paste API Keys Into Online Tools? Local Processing Explained

Learn why you should avoid pasting API keys, private keys and sensitive data into untrusted online tools, and how local browser processing can reduce unnecessary data exposure.

Read Article