Vanorika Technologies

Free tool

Email Header Analyser

Suspect a phishing email? Paste its full headers and we'll check if it's really who it claims to be.

100% private: headers are analysed in your browser and never sent to a server.

What this checks

  • Reads the Authentication-Results and ARC-Authentication-Results headers that your mail provider added when the message arrived.
  • Extracts the SPF, DKIM and DMARC verdicts and shows each as pass, fail, warning or not found.
  • Compares the domain in the visible From address with the domain in the Return-Path (envelope sender).
  • Counts the Received headers to show how many mail servers the message passed through. The analysis runs entirely in your browser.

Why it matters

Phishing emails often look perfect on screen, with the right logo and a familiar name, while the headers tell a different story. A finance clerk asked to change a supplier's bank details, or a parent asked to pay fees to a new account, can check the headers before acting. Because the analysis happens in the browser, the pasted headers are not sent to Vanorika or anyone else.

How to read the result

  • DMARC pass is the strongest single signal that the message genuinely came from the domain in the From line.
  • SPF or DKIM fail, or DMARC fail, means the message did not authenticate for the domain it claims. Treat it as suspicious and verify by phone using a number you already have.
  • A From and Return-Path mismatch is common with mailing lists and bulk senders, so on its own it is a warning, not proof of fraud.
  • Not found usually means the headers were copied incompletely. Copy the full original message, not just the visible fields.

How to fix what it finds

  • In Gmail, open the message, choose the three dot menu, then Show original, and copy everything. In Outlook, open the message and view its properties or message source.
  • Do not click links or open attachments in a message that fails DMARC; report it to your IT contact and delete it.
  • Confirm any request to change payment details by calling the sender on a number from your own records, not from the email.
  • If spoofed mail is arriving in your own domain's name, publish SPF and an enforcing DMARC policy so receivers can reject it.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

How can I tell if an email is fake?

Check the authentication results in the full headers. If DMARC fails, or SPF and DKIM both fail for the domain in the From line, the message is not verifiably from that organisation, however genuine it looks.

Can an email pass SPF and still be phishing?

Yes. An attacker can register a lookalike domain and set up SPF correctly for it. Always read the actual domain in the From address, and use the Lookalike Domain Finder to see which near copies of your own name exist.

Is it safe to paste email headers into this tool?

Headers contain addresses and server names but not the message body. This analyser runs in your browser and does not upload what you paste.

Related free tools