Skip to content
IT Solutions CenterDigital engineering partner
AR Start a project↗
ITSC / LIVE DIAGNOSTIC

Email Header & Spoofing Analyzer

Trace message routes, authentication results, and spoofing indicators in raw email headers.

Runs on demandNo account requiredActionable output
TOOL READYITSC DIAGNOSTICS / 408766

EMAIL FORENSICS · PRIVATE BY DESIGN

Understand what is hidden in
email headers.

Paste raw headers or open an EML file. We reconstruct the route, read SPF, DKIM, and DMARC, expose identity mismatches, and turn raw fields into an actionable report.

01 Local analysis02 Live DNS verification03 Message is never stored
MESSAGE / TRACE READY
01SENDER
02AUTH
03INBOX
SPFDKIMDMARCARCRECEIVED

Start investigation

Raw headers are enough.

Never paste a password or verification code. The tool needs message headers—not mailbox credentials.
Core processing stays on your device
Your privacy: Header text and message content never leave the browser. Live checks send only extracted domain names and public IP addresses.

How do you get the headers?

From your email application.

Copying visible message text is not enough; use “Show original” or “Internet headers.”
G

Gmail

Open the message → three-dot menu → Show original → Copy to clipboard.

O

Outlook Web

More actions → View → View message details Then copy the complete header.

M

Outlook Desktop

File → Properties → copy the contents of Internet headers.

Z

Zoho Mail

More → Show Original Then copy the raw text or download the EML file.

Report limitations

Technical evidence—not an absolute verdict.

Some fields can be forged, so we distinguish message claims from publicly verifiable evidence. Passing SPF, DKIM, or DMARC does not make content safe, and one failure alone does not prove fraud.

  • We do not open attachments or execute their content.
  • We do not access the mailbox or send a message.
  • We do not identify a person or precise location from an IP address.
  • The score measures technical header consistency—not message safety as a percentage.

Important questions

Before making a decision.

Can the real sender always be identified?

No. You may see the sending server, provider, and route recorded by the receiver, but large providers and relays hide the sender device address and some fields can be forged.

Is opening an EML file safe?

The tool reads the file in your browser and does not upload it. Still, use a message without secrets if you plan to share the report.

Why can live checks differ from Authentication-Results?

Headers record what happened at delivery time while DNS shows current configuration. Records may have changed, and full DKIM verification also requires the message body and contemporaneous key.

Is this a substitute for a security team?

No. It accelerates triage and initial analysis. Messages involving payments, credentials, or security incidents must be escalated to specialists without interacting with them.