Free tool
Is this email genuine?
Paste a message’s headers to see whether it passed SPF, DKIM and DMARC, whether replies are being redirected, and the route it took to reach you.
Runs entirely in your browser. Nothing you type is sent to us.
What the analyser looks for
Every server that handles an email adds lines to its headers. An email header analyzer reads those lines so you do not have to. This one checks four things:
- Authentication results — whether the receiving server found the message passed SPF, DKIM and DMARC.
- Reply-To redirection — replies quietly going to a different domain, a hallmark of invoice fraud.
- Display-name tricks — a name that shows one email address while the message comes from another.
- The route — each server the message passed through, and how long each step took.
Most payment fraud by email works by changing bank details on a real-looking invoice. Our answer page on business email compromise explains how it works and the simple controls that stop it.
Questions
About email headers
How do I find the full headers of an email?
In Outlook for Windows, open the message, choose File → Properties and copy the “Internet headers” box. In Outlook on the web, open the message, choose the three dots → View → View message source. In Gmail, choose the three dots → Show original. Copy everything from the top down to the first blank line.
Is it safe to paste headers here?
Yes. The analysis runs entirely in your browser; nothing is sent to us or anyone else. Headers contain names, addresses and server details, so it is still sensible not to paste them into tools that upload them.
Can headers prove an email is genuine?
They can show strong warning signs — failed DMARC, a reply address on another domain, a display name pretending to be someone else — but passing checks does not prove a message is safe. A criminal can authenticate a lookalike domain perfectly well. Verify any request for money or bank detail changes by phone, on a number you already hold.
What do I do if a message is suspicious?
Do not click links, open attachments or reply. Report it through Outlook’s report option or to your IT provider, and forward phishing emails to the National Cyber Security Centre at report@phishing.gov.uk. If money has been lost, call your bank immediately and report it to Report Fraud.
Seeing suspicious mail regularly?
Every MyExchangeServer mailbox includes multi-layer spam, malware and phishing filtering, with impersonation protection available. Tell us what is getting through.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers