247999.XYZ Tools / Check / Email headers Sign inCreate account

Email headers

Paste an email's headers to see the real sender, the servers it passed through and whether SPF, DKIM and DMARC checks passed. Runs in your browser.

In Gmail: open the email, ⋮ menu → Show original. In Outlook: ⋯ → View → View message source. Steps for other apps are below.

Is this email really from who it says?

The "From" line of an email is easy to fake. The headers behind it are not: every server that handles a message adds a line, and the receiving server records whether the sender passed its checks. This tool reads them and explains what they mean.

SPF, DKIM and DMARC in plain words

  • SPF checks that the server that sent the email is allowed to send for that domain.
  • DKIM checks a digital signature, which proves the domain sent it and nobody changed it on the way.
  • DMARC checks that the domain in the From address matches a passing SPF or DKIM result. A DMARC pass is the best sign the sender is real. A fail means treat it as fake.

These results are what your receiving mail server wrote into the headers. The tool reads them; it can't re-run the checks, and headers can be edited before they're pasted. Contradictions, such as a DMARC result for a different domain than the From address, are flagged.

How to find the headers

  • Gmail: open the email, click ⋮ (More) → Show original, then Copy to clipboard.
  • Outlook on the web: open the email, click ⋯ → View → View message source.
  • Outlook for Windows: open the email in its own window, then File → Properties, and copy "Internet headers".
  • Apple Mail: View → Message → All Headers, or Raw Source.
  • Yahoo Mail: open the email, click ⋯ → View raw message.

Questions

Are the headers sent to your server?

No. They're read in your browser. Headers can include your email address and IP, so we never see them.

The checks passed. Is the email safe?

It means the domain is real, not that the domain is honest. Scammers can pass every check from their own look-alike domain, so also check the address with the look-alike domain checker.