Email Header Analyzer

Understanding Email Headers & Phishing

What Are Email Headers?

Email headers are metadata attached to every email message. They contain technical details about the sender, recipient, routing path, and authentication results. Headers are normally hidden from view but reveal the true origin of an email, making them essential for detecting phishing and spoofing.

SPF (Sender Policy Framework)

SPF allows domain owners to specify which mail servers are authorized to send email on their behalf. When an email arrives, the receiving server checks the sender's IP against the domain's SPF record. A "pass" means the server is authorized; a "fail" may indicate spoofing.

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to outgoing emails. The receiving server verifies this signature against a public key in the sender's DNS records. If the signature matches, the email hasn't been tampered with in transit.

DMARC (Domain-based Message Authentication)

DMARC builds on SPF and DKIM by telling receiving servers what to do when authentication fails. It also provides reporting so domain owners can monitor for unauthorized use of their domain.

Common Phishing Indicators

• Mismatch between the "From" display address and the actual Return-Path
• Failed SPF, DKIM, or DMARC authentication
• Unusual relay paths through unexpected countries or servers
• Abnormal delays between mail server hops
• Recently registered sending domains

How to View Email Headers

• Gmail: Open email, click the three dots (⋮), select "Show original"
• Outlook: Open email, File > Properties > Internet Headers
• Apple Mail: View > Message > All Headers
• Yahoo Mail: Open email, click "More" > "View Raw Message"