Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Free tool
Paste the raw headers from a suspicious email to see what's actually behind it, SPF/DKIM/DMARC authentication results, whether the From, Reply-To, and Return-Path addresses actually match, and the full hop-by-hop delivery path back to the real sender.
Everything runs in your browser, the headers you paste here are never sent to our servers.
By using this tool, you agree to our Terms of Service , only run it against something you own or are authorized to assess.
One suspicious email is a data point, repeated targeting is a campaign. Talk to us about a real phishing assessment.