Paste the headers of a suspicious email to see who really sent it — and whether it’s spoofed
Every email carries a hidden block of headers that records where it came from. The From line you see in your inbox is written by the sender and can say anything — the headers show what the receiving mail server actually verified.
SPF checks whether the server that sent the message is allowed to send for that domain. DKIM checks a cryptographic signature that proves the message wasn’t altered and which domain signed it. DMARC ties the two to the visible From address: if it fails, the email is very likely pretending to be from someone it isn’t.
On top of that, the analyzer looks for display names that claim to be a well-known brand from an unrelated address, look-alike domains such as rnicrosoft or paypa1, replies redirected to another mailbox, the spam filter’s own verdict (Microsoft 365, SpamAssassin), the age of the sender’s domain, and whether the sending server’s IP is on a blacklist.
Passing every check proves the email really came from the domain it shows — not that the domain is honest. Scammers register their own domains and set up SPF and DKIM correctly. A domain created last week, a surprising request for money or passwords, or a link that leads somewhere else are still reasons to stop and check by phone.
The headers are read by JavaScript in your browser. To add context, the IP addresses found are looked up in public DNS (owner network and country), the source IP is checked against our blacklist check, and the sender’s domain is looked up in the public registration database. If you press Explain, a short summary of the findings is sent to an AI model running on Cloudflare. Nothing is saved.
mrpanos.com