How to get the headers
- Outlook (new and web): open the message → “…” → “View” → “View message details”.
- Outlook (classic): double-click to open the message → “File” → “Properties” → field “Internet headers”.
- Gmail: open the message → ⋮ → “Show original” → “Copy to clipboard”.
- Apple Mail: “View” → “Message” → “Raw Source” (⌥⌘U).
- Thunderbird: “View” → “Message Source” (Ctrl+U).
You can also paste the complete source; text after the first blank line is ignored.
Reading the delivery path
Every server that passes a mail on adds a Received line at the top. So the bottom line is the first hop and the top line the last one at your end.
Only the lines written by your own servers are trustworthy; anything below may have been invented by the sender. The delay is the difference between two timestamps. Large jumps are usually caused by greylisting, queues or spam filters, sometimes by wrong clocks.
SPF, DKIM and DMARC
- SPF checks whether the delivering server may send for the domain in the return path.
- DKIM checks a signature over headers and body. It usually survives forwarding.
- DMARC additionally requires SPF or DKIM to match the domain in the visible From. Only that protects against spoofed senders.
The result is in Authentication-Results, written by the receiving server. If a “pass” is missing, check the sender domain’s records in the SPF, DMARC and DKIM check and the hops’ IP addresses via reverse DNS in the DNS lookup.
Typical phishing signs
A reply-to address at a free mail provider, a display name that looks like another address, DMARC “fail” for a well-known brand, or a first hop in a completely different network than usual. None of these proves anything alone; several together are a strong signal.
FAQ
Are my emails uploaded?
No. The analysis runs entirely in JavaScript in your browser. Only if you click an IP address or domain does the corresponding tool open with that value.
Why is DMARC “fail” although SPF and DKIM are “pass”?
SPF and DKIM then apply to a domain other than the one in the visible From, often that of a mailing service. For DMARC to pass, at least one must match the sender domain, e.g. via a DKIM signature with your own domain at the mailing service.
What does SCL mean in Microsoft 365?
The Spam Confidence Level ranges from −1 (trusted) through 0–1 (not spam) to 5–9 (spam). From 5 the mail usually goes to the junk folder.
Why does the first hop show a private IP address?
Many senders pass mail internally from an application server to their mail gateway. For the origin, the first hop with a public address is what matters.
Can a sender forge Received lines?
The lines below the first foreign server, yes. The lines written by your own mail server and by the directly delivering server, no.