Email Header Analyser: Trace a Suspicious Email

What an Email Header is

An email header is the technical record above a message’s body. It contains sender fields and the receiving servers’ delivery records. This email header analyser turns that text into sender details, reported authentication results and a route.

The display name is the name your inbox shows. From contains the claimed author’s address. Return-Path records the address used for delivery failures, while Reply-To can direct your reply elsewhere. A familiar lender name alone does not establish who sent a message.

Received lines record mail-server handoffs. Authentication-Results records sender checks performed by a mail system. These fields follow the Internet message format. Paste the original header because an ordinary forwarded message can lose that evidence.

Processing stays in this tab’s memory. The tool does not upload headers, save them in browser storage or open addresses and links found in them. Clear header removes the active input and analysis. A header can contain client addresses and internal server names, so keep any copy under your brokerage’s information-handling rules.

Get the Email Header in Outlook and Gmail

Copy the complete original header from your mail program, then paste it into Full email header. The sender details visible beside a message’s subject are only a small part of that record.

1. In new Outlook or Outlook on the web, open the message. Choose More actions, then View and View message details. Copy the header text.
2. In classic Outlook for Windows, double-click the message to open its own window. Choose File, then Properties. Copy everything in the Internet headers box.
3. In Gmail in a desktop browser, open the message. Beside Reply, choose More, then Show original. Use Copy to clipboard.
4. In Apple Mail on a Mac, select the message. Choose View, then Message and Raw Source. Copy the header block above the first blank line.

Microsoft’s header instructions cover the Outlook versions. Google’s Gmail instructions show the original-message view. The University of Pennsylvania documents the Apple Mail source view.

Copying the entire raw message also works if its header comes first. The analyser stops at the blank line before the body. It accepts up to 200,000 characters.

Read the Analysis

Start with the From address and the reporting server beside each authentication result. This tool reads recorded results. It does not repeat the checks against DNS or verify a DKIM signature.

SPF checks whether a sending server is permitted for an envelope-sender domain. DKIM checks a domain’s cryptographic signature. DMARC checks whether a passing SPF or DKIM identity aligns with the visible From domain. Microsoft explains these recorded results.

Unverified pass means a pasted line reports a pass, but this tool cannot establish who wrote it. Unverified fail means a line reports a failure. None or Not reported supplies no passing result. Softfail and temporary or permanent errors need investigation.

Unverified mixed means the pasted records contain different outcomes for the same check. Separate servers or DKIM signatures can produce different results legitimately. Read the reporting server and identity for each record.

A pasted header can contain forged authentication and Received lines. Matching server names do not establish trust. Your mail administrator must confirm which results the receiving system actually added. The authentication-results standard explains that trust boundary. A pass cannot establish that a payment request is genuine or that an attachment is safe.

The route appears from oldest to newest. Mail servers add new Received lines above existing ones, as the SMTP standard specifies. Early lines can be forged. Server names and IP addresses describe recorded handoffs, not a verified person or physical location.

Worked Phishing Example

Reset example loads a fictional settlement email. Its display name says Example Lender Settlements and its From address is settlements@lender.example. The return-path and Reply-To use unrelated.example. Every domain and address in this example is illustrative.

The results show SPF Unverified fail, DKIM Unverified none and DMARC Unverified fail. The reported route starts at unknown.example, passes through gateway.broker.example and ends at mail.broker.example. The headline reads Investigate sender.

Those failures support pausing the request. A different return-path alone is weaker evidence because legitimate delivery services and forwarding can change it. The analyser compares exact domains and does not determine organisational-domain alignment or validate an ARC chain.

When the Header Shows a Fake

If the header suggests a fake lender or a changed reply destination, pause the requested action. Contact the lender using a number or portal you already trust. Confirm a settlement-account change through that separate channel before using it.

Keep the original message for your mail administrator. For the reporting and recovery steps, use the phishing email guide. If the email asks you to sign a document, check the DocuSign scam email guidance before opening the request.

Passing sender checks can also accompany a compromised genuine mailbox. Treat an unexpected instruction according to its content and your brokerage’s verification procedure, even when the header records a pass.