How to Get Raw Email Headers
Gmail
Open the email → click the three-dot menu (⋮) in the top right → Show original. Copy everything from the top of the page down to the blank line before the email body.
Outlook / Office 365
Open the email → click File → Properties. The headers are in the "Internet headers" box at the bottom. Or in Outlook on the web: open the message → three-dot menu → View → View message source.
Apple Mail
Open the email → go to View → Message → All Headers (or press Shift+Cmd+H). Select all and copy.
What Are SPF, DKIM, and DMARC?
SPF (Sender Policy Framework) — checks whether the sending mail server's IP is authorised to send on behalf of the domain in the From address. A fail suggests possible spoofing.
DKIM (DomainKeys Identified Mail) — a cryptographic signature verifying the email hasn't been tampered with in transit and was sent by an authorised server for that domain.
DMARC (Domain-based Message Authentication) — ties SPF and DKIM together. It tells receiving mail servers what to do if either check fails — reject, quarantine, or do nothing.
How this tool works
Everything happens in your browser. The header you paste is parsed by JavaScript on this page and is never uploaded — there is no request to our servers and no form submission carrying it. You can confirm that yourself: open your browser's network tab, paste a header, and you will see no request containing it.
The parser reads the fields that actually establish where a message came from and whether it was authenticated:
Received: — the relay chain, read bottom to top. The lowest entry is usually the first server that handled the message.Authentication-Results: — the receiving server's verdict on SPF, DKIM and DMARC.Return-Path: — the bounce address, which SPF is checked against. It often differs from the visible From address.Message-ID: — the originating system's identifier, whose domain is a useful cross-check.
A worked example
Here is a short, sanitised header. Read the Received: lines from the bottom upward:
Return-Path: <[email protected]>
Authentication-Results: mx.recipient.example;
spf=pass smtp.mailfrom=marketing.example.net;
dkim=pass header.d=example.net;
dmarc=fail header.from=bank-example.com
Received: from mx.recipient.example by inbox.recipient.example; Tue, 29 Sep 2026 09:14:02 +0100
Received: from smtp-out-3.marketing.example.net (198.51.100.24)
by mx.recipient.example; Tue, 29 Sep 2026 09:14:01 +0100
Message-ID: <[email protected]>
From: "Your Bank" <[email protected]>
Line by line:
- The lowest Received line shows the message entering from
smtp-out-3.marketing.example.net at 198.51.100.24. That is the sending infrastructure. Run it through our IP lookup to see which network operates it, or the IP reputation check to see whether it is a datacentre or flagged address.
- spf=pass means the sending server was authorised by
marketing.example.net — the domain in the Return-Path, not the one you see in From.
- dkim=pass header.d=example.net means the signature validated for
example.net.
- dmarc=fail header.from=bank-example.com is the important line. SPF and DKIM both passed, but for a different domain than the visible From address. DMARC checks that they line up, and here they do not. A message can show two green ticks and still be forged.
- The Message-ID domain matches the marketing host rather than the bank, which is the same story from another angle.
Timestamps also matter: a large gap between consecutive Received lines usually means a queue or a greylisting delay, not anything sinister.
What it cannot tell you
- Who wrote the message. Headers identify servers, not people.
- Whether the content is safe. Authentication passing only means the sender was authorised by that domain. Plenty of unwanted mail passes SPF, DKIM and DMARC.
- The sender's location. The originating IP resolves to a mail server, which is usually a hosting provider in another country entirely. Our own geolocation testing found providers disagreeing by more than 100 km on 4 of 15 addresses, so treat any city as indicative at best.
- Anything above the first trusted hop. Received lines added before the message reached a server you trust can be forged outright.
- Re-verification. We report the receiving server's stated SPF, DKIM and DMARC results; we cannot re-run those checks after the fact, because the DNS records may since have changed.
For a fuller walkthrough see how to read email headers, and how we test for how this tool is checked.
