Message header analyzer: expose spoofed email in seconds
Paste the full headers of any suspicious email and PhishingSonar reads them the way a SOC analyst would: authentication results, the true delivery path, and every sender mismatch. Free, no signup, and nothing you paste is ever stored.
Why headers are the ground truth
The text of an email is written by whoever sent it, and can say anything. The headers are written by the mail servers along the way, and are hard to fake consistently. That is why header forensics is the first forensic step in any real investigation: the headers either corroborate the story or contradict it.
What the analyzer checks
SPF, DKIM and DMARC results
These three authentication records answer one question: was this message sent by a server authorized to send mail for that domain? A dmarc=fail or spf=softfail on mail that claims to come from your bank is forensic evidence of spoofing, no matter how convincing the text looks.
The Received chain
Every mail server the message passed through appends a Received header. Read bottom-up, the chain shows the true path the message travelled. A claimed internal message that hopped through a residential IP or an unrelated country never touched your mail server at all.
From vs Reply-To vs Return-Path
The From address is what your mail client displays, and it is trivial to forge. The Return-Path shows the actual envelope sender, and Reply-To shows where your answer would go. When those three disagree, someone is counting on you not to look.
Spoofing fingerprints
Lookalike sender domains (paypa1.com, rnicrosoft.com), brand names hidden in subdomains (paypal.com.secure-login.io), missing Message-IDs, mismatched timestamps and forged display names all leave traces in the headers. A single field rarely convicts; the combination does.
How to find your email headers
Mail clients hide headers by default. Here is where to find them in the three most common clients:
Gmail
Open the message, click the three-dot menu at the top right, and choose "Show original". The full source, headers first, opens in a new panel. Use "Copy to clipboard".
Outlook / Microsoft 365
In new Outlook and Outlook on the web: open the message, click the three dots, then View, then "View message source". In classic Outlook desktop: double-click the message, then File, then Properties, and copy everything in the Internet headers box.
Apple Mail
Open the message, then choose View, Message, and "All Headers" (or Raw Source for the complete MIME tree). Select all and copy.
Copy everything, from the top Received: header down. Partial headers hide exactly the evidence the check needs.
Reading the results
After the check you get a structured report: a verdict, each indicator with the evidence behind it, the full header forensics breakdown, extracted IOCs you can hand to your security team, and recommended next actions. Passing authentication alone is not a clean bill of health: attackers can pass SPF and DKIM from their own lookalike domain. The report reads the headers together with the links, domains and social-engineering tactics in the body, so a convincing story cannot outrun its own metadata.
Frequently asked questions
- What is a message header analyzer?
- A tool that parses the technical headers of an email, the SPF, DKIM and DMARC authentication results, the Received chain, and the addressing fields, and turns them into a plain-language verdict about whether the message was spoofed or sent by an unauthorized server.
- Are email headers safe to share?
- Headers contain routing and authentication metadata, not your message body, though they can include sender and recipient addresses. PhishingSonar's built-in redaction can strip emails, phone numbers and IP addresses from your paste before anything is sent, and no content is ever stored.
- What does DMARC fail mean?
- It means the message failed SPF or DKIM alignment for the domain in the From address, so that domain did not authorize the sending server. For mail claiming to come from a major provider, a DMARC failure is strong evidence of spoofing.
- Can a phishing email pass SPF and DKIM?
- Yes. Attackers can pass authentication from their own lookalike domain, or abuse legitimate services. Passing SPF or DKIM proves the sending server was authorized for whatever domain it used, not that the message is trustworthy. That is why headers should be read together with the links and content.
- Do I need the full headers or just the summary?
- Full headers. Mail clients' summary views hide the Received chain and the envelope fields where most spoofing evidence lives. Paste the entire raw source for the complete check.
Have the headers in front of you?
Run the full analysis now. Built-in redaction scrubs personal details in your browser before anything leaves it, and the report is never stored.
Open the analyzer