Read an email's headers before you trust it.
Paste the headers of a message you doubt. The analyzer traces the servers it passed, checks each public address against FFraud's IP records, and reads your provider's SPF, DKIM and DMARC verdicts. The headers never leave your browser.
Behind every check
- 24.6 million
- IP addresses profiled
- 2.7 million
- malicious domains tracked
- 228,000
- disposable email domains
- 2.3 million
- networks scored
Counts read live from the engine, not written into the page. The full dataset is published on GitHub under the MIT license and rebuilt every 30 minutes.
How to copy the headers
The headers sit above the message text, hidden in most mail programs. Copy all of them, from the first line to the last.
Gmail
Open the message, click the three dots next to Reply, choose Show original, then Copy to clipboard.
Outlook
Open the message, choose More actions (the three dots), View, then View message details. In the Windows desktop app: File, Properties, and copy the Internet headers box.
Apple Mail
Choose View, then Message, then All Headers or Raw Source.
Yahoo Mail
Open the message, click the three dots, then View raw message.
Thunderbird
Choose View, then Message Source.
What the analysis looks at
The path
Every Received line is a server that handed the message on. Read from the bottom up, they trace the route from the sender to you.
The delivering server
The last handoff before your provider is written by your provider itself, so it is the one address the sender cannot forge. FFraud's record of it shows whether it is a mail service, a datacenter, a VPN or a known source of abuse.
SPF, DKIM and DMARC
Your provider's verdicts, read from the topmost Authentication-Results header. Lower copies of that header can be written by anyone.
Sender details
From, Reply-To and Return-Path, and whether they point to different domains.
Warning signs of a phishing email
A display name that carries another address than the real sender's. Replies sent to a different domain. DMARC failing for the domain in the From line. A message delivered from a VPN, a proxy or an address with a record of abuse. No single sign proves fraud, and passing every check does not make a message safe: a scammer can send from a real domain they own. Judge what the message asks you to do.
What happens to the headers
Nothing leaves your browser except the public IP addresses found in the headers, which are looked up one by one like any IP lookup on this site. The headers themselves, with the names and addresses in them, are never sent or stored.
Questions people ask.
A tool that reads the technical headers of an email: the servers it passed, the checks your provider ran and the sender details. It turns lines most people never see into an account of where a message came from.
Check three things: DMARC passed for the domain in the From line, the delivering server belongs to that domain's mail service, and the sender's name and Reply-To match the real address. Then judge the request itself: a real company does not ask for your password or an urgent payment by email.
Partly. Everything written before the message reached your provider can be invented: lower Received lines, extra Authentication-Results, X- headers. What your own provider adds at the top cannot, which is why the analysis trusts the topmost Received and Authentication-Results headers and treats the rest as claims.
Look at the server that handed the message to your provider: the analysis shows it as Delivered by. That is the sending mail server, which for a company is its mail service. A person's own device address is usually hidden; some webmail services add it as X-Originating-IP.
Yes. The analysis runs in your browser and the headers are never sent to us. Only the public IP addresses in them are looked up, the same way any IP lookup on this site works.
Do not click its links or reply. Report it with your mail provider's report phishing option, then delete it. If the analysis shows a hostile delivering server, report that address to FFraud so others can block it too.
Other free tools.
Free email checker
Format, disposable providers, role accounts, phishing domains, and known spam addresses in one verdict.
OpenWebsite safety check
Paste a link to check it against millions of known phishing and scam domains, plus the checks to run yourself.
OpenDMARC checker
Check a domain's DMARC policy, where its reports go, and the mistakes that stop it working.
OpenDo it in code.
The same answer from a free API endpoint, with the reason, the recency and the network around the address. Or download the confirmed blocklist for bulk blocking. No card, no quota, no expiry.