Skip to main content

Email header analyzer

Paste raw email headers (or the full source). We'll parse the key fields, surface the SPF / DKIM / DMARC verdicts, and flag the common spoofing indicators.

In Gmail: open the email, click the three-dot menu, → "Show original" → copy the text. In Outlook: File → Properties → Internet headers.

Example result for example.com

Sample data. Run the check above to see yours.

DMARC failed

Failing

The message claims to be from example.com but passed neither SPF nor DKIM for that domain.

From billing@example.com
Return-Path bounce@examp1e-mail.net
Sending IP 203.0.113.45
  • Return-Path domain does not align with the From domain.

Want ongoing monitoring?

This tool is a one-shot check. PhishFence watches your domain with automated hourly monitoring (daily on Free) for DMARC changes, new lookalike registrations, and spoofing attempts.

Start free monitoring