TOOLBOX · EMAIL & DOMAIN
Read Email Headers.
Paste the headers of a suspicious email: message path with delays, the SPF, DKIM and DMARC results and signs of forgery. No upload, only in your browser.
HOW THE ANALYSIS READS THE HEADER
Fields
with Sources.
Only what is in the headers is evaluated. The analysis does not query DNS and does not contact any of the servers named.
Received
Each hop records sender, recipient, protocol and time. This gives the path, the delays and whether TLS was used.
RFC 5321, Section 4.4Authentication-Results
Your mail server’s check result for SPF, DKIM and DMARC. The top result counts, because it comes from your own system.
RFC 8601DMARC Alignment
If there is no DMARC result, the analysis recalculates whether SPF or DKIM match the domain in From, without a DNS lookup.
RFC 7489, Section 3.1From, Reply-To, Return-Path
Visible sender, reply address and envelope sender. If they differ, the analysis shows what that means.
RFC 5322Microsoft 365
Exchange Online writes results without a server identifier and adds compauth, an overall assessment from SPF, DKIM, DMARC and other signals.
Microsoft LearnForwarding (ARC)
Mailing lists and forwarding can break SPF and DKIM. ARC records how the forwarding service assessed the message beforehand.
RFC 8617
NEXT
Protect Your
Own Domain.
Email Security Check
Can someone forge emails in your name? Check your domain’s SPF, DKIM, DMARC, MTA-STS and TLS-RPT.
Check Domain (German)SPF, DKIM and DMARC as PDF
From an inventory of all senders to the p=reject policy: the rollout plan with DNS examples.
Go to DownloadBusiness Email Compromise (BEC)
Recognize and fend off fake CEO and supplier emails with payment requests.
In the Glossary
QUESTIONS
Good to Know.
Are my headers transmitted?
No. The analysis runs entirely in your browser. Headers contain names, email addresses, server names and IP addresses; that is why the page sends them nowhere, does not store them and deliberately offers no file upload.
Where can I find the headers of an email?
In classic Outlook: open the message, File › Properties, field “Internet headers”. In Outlook on the web and the new Outlook: … (More actions) › View › View message details. In Gmail: open the message, ⋮ next to “Reply” › Show original.
Can Received lines be forged?
Yes. Every server adds its Received line at the top (RFC 5321, Section 4.4). Only the lines your own mail system added, usually the top ones, are reliable. Everything below may have been written by the sender.
What do SPF, DKIM and DMARC mean in the result?
SPF says whether the sending server may send for the envelope domain (RFC 7208). DKIM is a domain’s signature showing that the message has not been changed since it was signed (RFC 6376). DMARC confirms the visible sender domain if SPF or DKIM pass for the same organization (RFC 7489).
DMARC failed. Is the message forged?
Often, but not always. Forwarding and mailing lists can break SPF and DKIM; ARC exists for that (RFC 8617). For payment requests, changed bank details or requests for credentials, always check with the sender through a channel you know.
Why are the times shown in Austrian time?
Each server writes the time in its own time zone. The analysis converts all timestamps to Austrian time so that delays between hops can be compared directly.
YOUR NEXT STEP
You Have the Result.
What Comes Next?
We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.