Email Header Analyzer

Paste raw email headers below to trace the real sender, view relay hops, and check SPF/DKIM/DMARC authentication results. (日本語)

100% private — your email headers never leave your browser
Please paste email headers to analyze.

PhishClean scans every page you visit for phishing signals — not just emails.

The browser extension monitors web pages in real time, catching threats that email header analysis alone cannot detect.

Real-time phishing page detection
Password fields on suspicious pages
Hidden iframes stealing credentials
Domain spoofing and lookalike URLs
HTTPS downgrade attacks
API keys and tokens exposed in URLs
Install PhishClean free

How to find email headers

Gmail

  1. Open the email you want to analyze.
  2. Click the three-dot menu (top-right of the email).
  3. Select Show original.
  4. Copy everything in the text box that appears and paste it above.

Outlook (Desktop)

  1. Open the email, then click File > Properties.
  2. In the Properties dialog, find Internet headers at the bottom.
  3. Select all the text in that box, copy it, and paste it above.

Outlook (Web)

  1. Open the email, then click the three-dot menu (top-right).
  2. Select View > View message source.
  3. Copy the headers from the new window and paste them above.

Apple Mail

  1. Open the email in Apple Mail.
  2. Go to View > Message > All Headers (or press Cmd + Shift + H).
  3. Copy the displayed headers and paste them above.

Frequently asked questions

How do I find email headers?

Every email client stores headers differently. In Gmail, open the email and select "Show original" from the three-dot menu. In Outlook, open the message properties to find Internet headers. In Apple Mail, go to View > Message > All Headers. The headers contain routing, authentication, and metadata that reveals how the email traveled to your inbox.

What do SPF, DKIM, and DMARC mean?

SPF (Sender Policy Framework) checks whether the sending server is authorized by the domain owner. DKIM (DomainKeys Identified Mail) verifies the email has not been tampered with using a cryptographic signature. DMARC (Domain-based Message Authentication, Reporting and Conformance) combines SPF and DKIM and tells receiving mail servers how to handle messages that fail these checks. Together, they are the backbone of email authentication and help prevent spoofing.

Can this tool tell if an email is phishing?

This tool flags common indicators of spoofed or suspicious emails: failed authentication (SPF/DKIM/DMARC), mismatched sender addresses (From vs Return-Path), and unusual relay paths. However, sophisticated phishing emails can pass all authentication checks. Use this as one data point — also watch for urgency language, unexpected requests, and suspicious links in the email body.

Are my email headers stored anywhere?

No. Everything runs entirely in your browser using JavaScript. The headers you paste are never sent to PhishClean or any third-party server. You can verify this yourself by opening your browser's developer tools (Network tab) while running an analysis — you will see zero outbound requests.

How do I read email headers?

Read the Received lines from the bottom up: the lowest one is the first server that accepted the message, and each line above it is the next hop. Then compare the From address with the Return-Path, and check the SPF, DKIM and DMARC results. This analyzer does that for you and lists the hops in order.

How can I tell if an email is spoofed?

Warning signs include an SPF or DMARC failure, a Return-Path or Reply-To on a different domain from the From address, and a first hop from a server that has nothing to do with the sender's organisation. One sign on its own isn't proof, because mailing lists and forwarding can cause mismatches, but several together are a strong signal.

Can I find the sender's IP address from email headers?

Often, yes. The earliest Received header added outside the sender's own network usually shows the IP address that sent the message. Large providers such as Gmail and Outlook.com usually hide the sender's own device IP, so you will often see the provider's mail server instead.

What does a DMARC fail mean?

It means the message didn't meet the policy the domain owner published: neither SPF nor DKIM passed for a domain that matches the From address. Depending on that policy, the receiving server may send it to spam or reject it. A DMARC failure on an email claiming to be from your bank is a strong reason not to trust it.

Last updated: