🛡️ Email Header Analyzer

Review authentication results reported in pasted headers, compare sender fields, inspect routing information and list visible header URLs. This local check is not a malware, reputation or phishing-verdict service.

Local header processing • No API or reputation lookup • Results are indicators only

📧 Single Email Analysis

How to get email headers:

Gmail: Open suspicious email → Click 3 dots (⋮) → "Show original" → Copy ALL the text
Outlook: Open email → File → Properties → Copy "Internet headers"
Yahoo: Open email → More → "View raw message" → Copy text
Apple Mail: Open email → View → Message → Raw Source → Copy text

Tip: Paste the original/raw message headers, not only the visible From, To and Subject fields.

Privacy note: Headers can contain email addresses, IP addresses, message identifiers and routing details. The tool processes them locally, but you should still avoid sharing exported results publicly without reviewing them.

📦 Batch Email Analysis

Compare locally derived header indicators for several messages. No DNS, reputation or attachment checks are performed.

📧 Email #1

🎓 Email Security Learning Center

Learn how to identify email threats and improve your security awareness.

🎣

Phishing Detection

Learn to identify and avoid phishing attempts

🎭

Email Spoofing

Understand how attackers fake sender identities

🔍

Reading Headers

Master the art of email header analysis

🔐

Email Authentication

Learn about SPF, DKIM, and DMARC

Frequently Asked Questions

How is my pasted header data handled? +

The pasted text is processed locally by this tool and is not uploaded to ToolCookie or saved in browser storage. The page may still load external resources such as Google Fonts. Browser extensions, shared devices and copied or downloaded reports remain separate privacy considerations.

What do SPF, DKIM, and DMARC mean? +

SPF, DKIM and DMARC are email-authentication mechanisms. This tool does not perform those checks itself; it reports values found in Authentication-Results headers. A pass does not prove that a message is trustworthy, and a fail can occur for reasons such as forwarding or configuration problems.

Can I use this tool on mobile devices? +

The layout is designed to adapt to smaller screens in current browsers. Handling very large raw headers may still be less convenient or use more memory on some mobile devices.

What should I do when indicators warrant review? +

Treat warnings as reasons for further verification, not proof that the message is malicious. Avoid opening unexpected links or attachments and contact the claimed sender through a separately obtained official channel. Preserve or report the message if your workplace or provider requires it rather than deleting evidence immediately.

How accurate are the security assessments? +

The results are limited heuristics based only on pasted text. The tool cannot verify whether Authentication-Results headers are trustworthy, query DNS or reputation systems, scan attachments, follow redirects or determine whether a message is legitimate. Use the output as educational guidance only.