Tidy My Mac
Free tool
Email header analyzer: who really sent this email?
Paste an email's full headers to see whether it passed SPF, DKIM and DMARC, which server really sent it, and where your reply would go. The headers are read in your browser and never uploaded.
How to copy an email's headers
- Mail on Mac: select the message, choose View ▸ Message ▸ All Headers (Shift-Command-H), then select and copy the lines above the message text. Or choose View ▸ Message ▸ Raw Source and copy the top part, up to the first blank line.
- Gmail: open the message, click the three dots next to Reply, choose Show original, and copy everything above the message.
- Outlook: open the message, choose File ▸ Properties (Windows) or View Source (Mac, web), and copy the Internet headers.
What SPF, DKIM and DMARC tell you
- SPF checks that the server that delivered the email is allowed to send mail for the domain in its envelope (the Return-Path).
- DKIM checks a signature added by the sending domain, proving the message wasn't changed on the way.
- DMARC ties them to the address you see in From: it passes only when SPF or DKIM passed for that same domain. A DMARC fail on an email from your bank means someone else wrote it.
The results are written by your own mail provider when the email arrives, in the Authentication-Results header, and this tool reads them. A pass proves which domain sent the message, not that the domain is honest: scammers register look-alike domains and set up SPF and DKIM too, so read the From domain carefully.
Other things the headers reveal
- A Reply-To on a different domain, so your answer goes to the scammer rather than the company.
- A display name that contains a different email address, to show a trusted address in your inbox.
- A free mailbox (Gmail, Outlook, Yahoo) sending in the name of a bank, a shop or a government office.
- The chain of Received lines, read from the bottom up: the first server the email passed through.
Questions about email headers
Look at the Authentication-Results header: a DMARC fail, or SPF and DKIM failing for the From domain, means the sender's address is forged. Paste the headers here to have them read for you.
No. The analysis runs in your browser with JavaScript, and nothing you paste is sent to our server or anyone else's.
It means the email really came from the domain in its From address. Whether that domain belongs to who it claims is another question: check it with our website scam checker, and be careful with any link or attachment.
Some providers don't add them, or you may have copied only part of the headers. Copy everything from the top of the message down to the blank line before the text.
More free security tools
Website scam checker
Type a site or paste a link: our scam and phishing lists, the domain's age and look-alike names.
Open the tool →Scam message checker
Paste an email, text or DM: the scam signs in it, and its links checked against our lists.
Open the tool →Password checker
Has a password leaked in a data breach, and how long would it take to crack? It never leaves your browser.
Open the tool →Password generator
Random passwords and passphrases, made in your browser with the length and characters you choose.
Open the tool →Mac app vulnerability checker
Is your version of Chrome, Firefox, VLC or another app safe? Known holes and the version that fixes them.
Open the tool →Report a harmful site
Found a phishing page, fake shop or scam site? Report it and we'll review it for our lists.
Open the tool →Is this email a scam? How to check before you click
Check the sender and links in a minute, and what to do if you already clicked.
Read the guide →Phishing check on Mac: is this link, message or site fake?
Check a link or sign-in page before you click, and what to do if you already did.
Read the guide →Scan your Mac for malware, free for 7 days.
Just your email, no credit card. Then $19.99 for your first year, $59.99 a year after that.
Scan your Mac free