E-mail header analyzer
Paste the headers of a message to see where it really came from, how long each server kept it, whether it passed SPF, DKIM and DMARC, and what looks wrong.
Runs entirely in your browser: the headers are never sent to us or anyone else.
How to get the headers
- Gmail: open the message, ⋮ menu, Show original, then copy everything.
- Outlook (web): open the message, … menu, View, View message source.
- Outlook (desktop): open the message in its own window, File, Properties, Internet headers.
- Apple Mail: View, Message, All Headers (or Raw Source).
- Thunderbird: View, Message Source (Ctrl+U).
Are messages being forged in your name?
Perimetry Cloud reads the DMARC reports of your domains every day and tells you who sends mail as you, then takes you to p=reject step by step.
Questions
What do SPF, DKIM and DMARC mean here?
SPF says which servers may send mail for the domain of the bounce address; DKIM is a signature added by the sending server; DMARC passes when SPF or DKIM passes for a domain that matches the one in From. Only DMARC tells you that the visible sender is genuine.
Why does the From address look right but DMARC fail?
Because anyone can write any From address. DMARC failing for a domain like your bank’s, with the address looking right, is the classic sign of a forged message.
Are my headers stored?
No. The analysis runs in your browser and the page sends nothing. You can disconnect from the internet after loading it and it still works.
Why is "aligned" important?
A message can pass SPF or DKIM for another domain than the one you see (a mailing service, for example). DMARC requires one of them to pass for the domain in From, or one of its subdomains.