Tool
Analyze Email Headers
Paste the source of an email and see what its headers reveal: whether SPF, DKIM, and DMARC passed, who is really behind the sender, where replies go, and which servers the message passed through. The text never leaves your browser.
How to read email headers
Authentication-Results
On receipt, your mail provider checks SPF, DKIM, and DMARC and writes the result into the email as a header. Because every server adds new headers at the top, only the topmost one is from your provider. Further down, the sender may have written in any "results" they like.
Why DMARC matters
SPF checks the invisible envelope address, DKIM the domain of the signature. Both can pass for a foreign domain. Only DMARC requires one of them to match the visible domain in From - only then is the sender proven.
Received chain
Every server that passes the email on adds a Received header at the top. Read from bottom to top, they show the route. The lower entries come from the sender and can be forged; only the handover to your mail provider is reliable.
From, Reply-To, Return-Path
From is the displayed sender address, Reply-To the destination of your reply, and Return-Path the address for delivery errors. If they differ, that is normal for sending services - but a warning sign for a supposedly personal email.
Analyze your own DMARC aggregate reports with the DMARC Report
The pasted text is analyzed exclusively in your browser. It is not transmitted to the server and is stored neither there nor in your browser - it is gone once you discard the analysis, reload, or close the page. The analysis only reads what is in the headers and looks nothing up. It does not replace checking links and attachments.