Is that email really from who it says?
Every email carries hidden headers that record which servers handled it and whether it passed the authentication checks that catch spoofing. Paste the raw headers below. Parsing happens entirely in your browser — the email is never uploaded anywhere.
How to get the raw headers
Gmail
- Open the email
- Click the three-dot menu at the top right of the message
- Choose "Show original"
- Copy everything on that page
Outlook
- Open the message in its own window
- File → Properties
- Copy the "Internet headers" box
Apple Mail
- Select the message
- View → Message → All Headers
- Copy the header block
What the results tell you
The Received chain lists every server that handled the message, newest at the top. The oldest hop usually contains the IP address of the server that first sent it — you can run that address through our IP lookup to see which network and country it belongs to. SPF, DKIM, and DMARC are the three authentication checks mail providers use to catch forged senders. A DMARC fail on a message claiming to be from your bank is close to proof of spoofing.
What headers cannot tell you
Headers identify servers, not people. A message sent through Gmail shows Google's servers, not the sender's home connection. And any header below the first hop your own provider wrote can be forged by the sender. Treat the analysis as evidence to weigh, not a verdict — and never trust an email just because it looks clean.
Related reading: what an IP can actually reveal and how modern phishing scams work.