Who really sent this, and where did it stall?

Paste the full headers of a message. The analyser shows the real sender and reply address, whether SPF, DKIM and DMARC passed, every server the message passed through with the delay at each hop, and what Microsoft 365, Google or SpamAssassin decided. It runs entirely in your browser.

Private by design

Headers contain names, addresses and internal server names. This page parses them locally with JavaScript and makes no network request. Refresh the page and they are gone.

Getting the headers

Where to find them in each mail client.

Outlook (new and web): open the message, select the three dots, then View › View message source (or View message details). Copy everything.
Outlook (classic desktop): open the message in its own window, File › Properties, copy the Internet headers box.
Gmail: open the message, select the three dots, Show original, then Copy to clipboard.
Apple Mail: View › Message › All Headers, then copy from the top of the message.
Microsoft 365 admins: Exchange message trace shows the path but not the headers; use the recipient's copy of the message.

Forwarded messages carry the forwarder's headers, not the original sender's. Ask for the message as an attachment (.eml) and open that instead.

How to read the result

Authentication shows the SPF, DKIM and DMARC verdicts as recorded by the server that received the message, plus whether the SPF and DKIM domains align with the visible From domain. DMARC passes only when at least one of them aligns. On Microsoft 365 you will also see the composite verdict (compauth) and its reason code.

Observations flags the patterns that matter in business email compromise: a Reply-To pointing at a different domain, a display name that contains a different email address, a missing Message-ID, a Date header that disagrees with the server timestamps.

Delivery path lists every server that handled the message, oldest first, with the delay at each hop. Delays inside your own tenant point at filtering or rules; delays before the message reached you are the sender's problem. Each IP address links to a reverse DNS lookup.

Filter verdicts decodes Microsoft's X-Forefront-Antispam-Report (SCL, SFV, BCL, connecting IP), SpamAssassin scores, and markers from Proofpoint and Mimecast.

Common questions

SPF passed but DMARC failed. How?

SPF is evaluated against the bounce address (Return-Path), which for marketing and ticketing platforms is usually the platform's own domain. DMARC needs the passing domain to align with the From domain. In that situation, only DKIM signed with your domain can make DMARC pass.

Everything passed but the message is still a fraud.

Authentication proves the message came from the domain it claims, not that the domain is honest. Look-alike domains (sigma-labs versus sigmalabs) pass perfectly. Check the From domain letter by letter, and look at the Observations section for Reply-To and display-name tricks.

Why are some hops missing timestamps or in the wrong order?

Not every server writes a complete Received header, and clocks drift. The analyser tolerates both and shows what it can. A small negative delay is clock skew, not time travel.

Check the sender's domain Reverse-lookup an IP

Next step

Getting phishing through, or legitimate mail blocked?

We tune Microsoft Defender and Google Workspace filtering, put DMARC into enforcement, and set up the reporting that shows you what is being sent in your name.

Discuss Your Environment Email and identity security