Free client-side email header analyzer

Check suspicious email headers

Email headers show how a message traveled and whether the receiving provider recorded SPF, DKIM, and DMARC authentication. They can also reveal a Reply-To or Return-Path domain that differs from the visible sender.

This free parser runs entirely in your browser. It does not upload or store the headers. Remove personal addresses, internal hostnames, and identifiers if your policy requires redaction.

Analyze email headers Read FAQ

Quick answer

Authentication is evidence, not proof

SPF, DKIM, and DMARC failures increase risk, while passes only show that parts of the sending infrastructure authenticated. A compromised legitimate mailbox can still pass authentication.

Private browser-side analysis

Paste the full raw headers

The sample demonstrates a Reply-To mismatch and failed authentication. Replace it with headers copied from your mail client's 'Show original' or 'View source' screen.

How to get the raw headers

Mail providers use different labels, usually Show original, View source, View message details, or Internet headers.

  • In Gmail, open the message menu and choose Show original.
  • In Outlook, view message details or Internet headers.
  • Copy the header block, not only the visible From and Subject fields.
  • Redact internal addresses or identifiers when required by your organization.

What the checker reads

The parser extracts common authentication results and compares domains that influence where replies and bounces go.

  • SPF: whether the sending server was authorized for the envelope domain.
  • DKIM: whether a cryptographic message signature verified.
  • DMARC: whether SPF or DKIM passed with alignment to the visible From domain.
  • Reply-To, Return-Path, and Message-ID domain differences.

Important limitations

Header analysis reduces uncertainty but cannot establish whether a person or business authorized a request.

  • Forwarding and gateways can alter authentication results.
  • A compromised real mailbox can pass SPF, DKIM, and DMARC.
  • Missing headers may reflect what your mail client copied, not what the server received.
  • Verify payments, passwords, and account changes through a separate known channel.

Sources and verification

Use primary sources and the provider's official support channel before acting.

Email Header Checker FAQ

Does an SPF, DKIM, and DMARC pass mean the email is safe?

No. Authentication can pass for a malicious sender's own domain or a compromised legitimate mailbox.

Why can a legitimate forwarded message fail authentication?

Forwarding or gateway modification can break SPF or DKIM. ARC and provider context may help preserve prior authentication.

Are headers uploaded to ScamSpot?

No. This header parser runs locally in your browser and does not send the pasted headers to the ScamSpot API.

What should I do with a Reply-To mismatch?

Do not reply through the message. Contact the supposed sender through a known address, phone number, app, or official website.