Incident Response
Email Header Analyzer
Email headers are the evidence trail behind every phishing report. Paste the raw headers and this tool reads the SPF, DKIM and DMARC verdicts, reconstructs the delivery path and highlights the sender mismatches that reveal spoofing.
Parsing happens entirely in your browser. Headers can contain personal data, so it matters that nothing you paste here is uploaded, logged or retained.
What the verdicts mean
- SPF pass -- the sending IP is authorised to send for the envelope domain.
- DKIM pass -- the message carries a valid cryptographic signature from the signing domain.
- DMARC pass -- SPF or DKIM aligned with the visible From domain. This is the one that stops display-name spoofing.
- All three can pass and the mail can still be malicious: an attacker sending from their own correctly configured domain passes authentication.
- Read Received hops from the bottom upwards; the earliest hop is closest to the true origin, and hops below your own infrastructure can be forged.
Related tools
Phishing URL Inspector
Break a suspicious URL into its parts and flag common phishing and obfuscation traits.
File Hash Calculator
Compute SHA-256, SHA-384 and SHA-512 file hashes without uploading the file anywhere.
IOC Defanger / Refanger
Safely defang and refang URLs, domains, IPs and emails when sharing indicators.