Paste raw email headers below to trace the real sender, view relay hops, and check SPF/DKIM/DMARC authentication results.
The browser extension monitors web pages in real time, catching threats that email header analysis alone cannot detect.
Cmd + Shift + H).Every email client stores headers differently. In Gmail, open the email and select "Show original" from the three-dot menu. In Outlook, open the message properties to find Internet headers. In Apple Mail, go to View > Message > All Headers. The headers contain routing, authentication, and metadata that reveals how the email traveled to your inbox.
SPF (Sender Policy Framework) checks whether the sending server is authorized by the domain owner. DKIM (DomainKeys Identified Mail) verifies the email has not been tampered with using a cryptographic signature. DMARC (Domain-based Message Authentication, Reporting and Conformance) combines SPF and DKIM and tells receiving mail servers how to handle messages that fail these checks. Together, they are the backbone of email authentication and help prevent spoofing.
This tool flags common indicators of spoofed or suspicious emails: failed authentication (SPF/DKIM/DMARC), mismatched sender addresses (From vs Return-Path), and unusual relay paths. However, sophisticated phishing emails can pass all authentication checks. Use this as one data point — also watch for urgency language, unexpected requests, and suspicious links in the email body.
No. Everything runs entirely in your browser using JavaScript. The headers you paste are never sent to PhishClean or any third-party server. You can verify this yourself by opening your browser's developer tools (Network tab) while running an analysis — you will see zero outbound requests.