Email Header
Analyzer

Every email carries hidden metadata called headers that record the message's journey: which servers handled it, when, and whether authentication checks (SPF, DKIM, DMARC) passed. An analyzer decodes that raw text into something readable and flags signs of spoofing — like a display name impersonating a brand, an envelope sender that doesn't match the visible From address, or failed authentication checks.

Yes — because nothing leaves your device. The analysis runs entirely in your browser with plain JavaScript. Your headers are never uploaded, stored, or transmitted anywhere, and the tool works offline after the page loads. That matters for security forensics: the whole point is to inspect potentially malicious mail without sharing it with yet another service.

Open the email, click the three-dot menu (⋮), choose 'Show original', and copy everything from the new tab — or use 'Download original' to get the raw message. Paste the whole thing into the analyzer. Outlook: open the message, click the ⋯ menu → View → View message source (web) or double-click → File → Properties → Internet headers (desktop). Apple Mail: open the message, View → Message → Raw Source.

They are the three email authentication standards: SPF verifies the sending server is authorized to send for the claimed domain, DKIM verifies the message was signed by the domain and not tampered with, and DMARC ties them together by telling receiving servers what to do when both fail. A pass on all three makes spoofing unlikely; failures don't always mean spam (forwarding and mailing lists break them), but combined with other red flags they are a strong warning.

The big ones: a display name that impersonates a well-known brand or person while the actual address is unrelated; a Reply-To or Return-Path domain that differs from the From domain; SPF or DMARC failures; urgent language demanding credentials or payments; and a message ID or sending server that doesn't match the claimed sender. One red flag is worth a closer look; several together mean treat it as an attack.

No — and that's deliberate. The tool is fully client-side, so it never makes network calls (that would both leak the header and require a backend). Instead it reads the authentication verdicts that the receiving mail server already recorded in the Authentication-Results header, plus structural clues in the Received chain. It gives you a strong forensic read without ever sending your data anywhere.