SITE UNDER CONSTRUCTION. Everything here is provided AS IS, WITHOUT WARRANTIES, to the extent the law allows. It is information, not professional advice. Use at your own risk. Terms and liability limits →

eThorns ES
Menu
Buy us a coffeeEspañoleThorns 2026 · Made in Colombia
← DNS, email & networkES

Tool 2.5

Email header analyzer (Received chain, SPF, DKIM)

Paste an email's raw headers to see the servers it passed through, the SPF, DKIM and DMARC results your provider recorded, and signs of a forged sender.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

An automated check; it doesn't guarantee security.

How to use it

  1. Open the email and look in your mail app's menu for Show original, View source or similar. Copy everything from the top down to the first blank line.
  2. Paste it in the box and click Analyze headers. The text is read in your browser and isn't sent anywhere.
  3. Read the warning signs first, then the authentication results and the chain of servers, listed oldest first.

What the headers show that the sender's name doesn't

The name you see in the inbox, like “Tu Banco”, is typed by whoever sends the message and can say anything. The headers are the lines above the message that mail servers add as it travels: which server passed it to which, at what time, where replies will go, and what your own provider concluded when it checked SPF, DKIM and DMARC.

This tool reads those lines and lays them out: a summary of the sender fields, a list of warning signs, the authentication results and the chain of servers. It works only with the text you paste and looks nothing up on the internet. It also doesn't run the SPF or DKIM checks itself: it shows the verdicts your provider wrote in the Authentication-Results header.

Example: an “update your details” email that isn't from the bank

A message with the subject “Actualiza tus datos” has these headers: From: "soporte@tubanco.co" <alertas@tienda-ejemplo.co>, Reply-To: <cobros@example.net>, and an Authentication-Results line with spf=fail, dkim=none and dmarc=fail.

The tool lists four warning signs. The display name is an address, soporte@tubanco.co, but the real sender is alertas@tienda-ejemplo.co. Replies would go to example.net, a third domain. SPF failed: the server that sent it isn't allowed to send for tienda-ejemplo.co. And DMARC failed: neither SPF nor DKIM proved the message comes from the domain in From. Together they say the bank didn't send it: don't reply and don't open its links.

Which lines to trust, and when a mismatch is normal

Each server adds its Received: line at the top, so the chain is read from the bottom up; the tool lists it oldest first. Only the lines your own provider added, at the top, are reliable. Anything below them may have been written by the sender, fake Received lines included. The same goes for Authentication-Results: trust the one your provider added.

A different Return-Path is common in genuine mail: invoicing platforms, newsletters and help desks collect bounces on their own domain, so the tool marks it in amber, not red. A mailer flagged as a script or bulk-mail tool is similar, since shops and newsletters use them too. Both matter only alongside other signs. The delay column compares each server's clock with the previous one; a negative delay marked (skew) means two clocks disagree.

FAQ

How do I see the full headers in Gmail, Outlook or Apple Mail?

In Gmail on the web, open the email, click the three dots next to Reply and choose “Show original”. In Outlook on the web, open the message, click the three dots, then “View” and “View message source”. In Apple Mail on a Mac, open the message and press Option-Command-U (View > Message > Raw Source). Most phone apps don't show the full headers, so open your account in a computer's browser.

What's the difference between SPF, DKIM and DMARC?

SPF is a list, published in a domain's DNS, of the servers allowed to send its mail. DKIM is a signature the sending server adds, which shows which domain signed the message and that it wasn't changed on the way. DMARC checks that at least one of the two passed for the domain shown in From, and tells receivers what to do when neither did: nothing, the spam folder or reject.

Why does a genuine email show a different Return-Path?

Companies that send invoices, receipts or newsletters often do it through services like SendGrid, Amazon SES or Mailchimp, which use their own domain in `Return-Path` to collect bounces. If DKIM is signed with the company's own domain and DMARC passes, that difference is expected.

Can the Received lines be faked?

The sender can add fake `Received:` lines before sending. What they can't change are the lines your provider's servers add when the message arrives, at the top, nor the `Authentication-Results` line your provider writes. Those are the ones to believe.

If SPF, DKIM and DMARC pass, is the email safe?

Not necessarily. A scammer who sends from a domain they own, with SPF, DKIM and DMARC set up, passes all three. The checks prove which domain sent the message, not that it's honest, so look at that domain: `tubanco-seguridad.co` passing DMARC is still not `tubanco.co`.

Guides for this tool

  • 2.1What's my IP?See your public IP address, whether it's IPv4 or IPv6, your country, TLS and HTTP version, and what every website can learn from your connection.
  • 2.2Email securityCheck a domain's SPF, DKIM, DMARC, MTA-STS, BIMI and DNSSEC, and get copy-ready DNS records for what's missing or wrong.
  • 2.3SPF record builderBuild one SPF record for your domain from your mail services, servers and IP ranges.
  • 2.4DNS lookupLook up any domain's DNS records (A, AAAA, CNAME, MX, TXT, NS, SOA, CAA, SRV) or the reverse DNS of an IP, with TTLs and DNSSEC validation.
  • 2.6DNS propagation checkerAsk 10 public resolvers (Google, Cloudflare, Quad9, OpenDNS…) for a name's A, AAAA, CNAME, MX, NS or TXT records and see if your DNS change reached them.
  • 2.7DMARC report readerOpen a DMARC aggregate report (.xml, .xml.gz or .zip) and see, for each sending IP, how many messages passed or failed SPF and DKIM.
  • 2.8Is it down?Check whether a website answers, with its HTTP status, response time, redirects and HTTPS, measured once from our server in Colombia.
  • 2.9DMARC record generatorBuild a DMARC TXT record: policy, test mode, report addresses and alignment.
  • 2.10Link preview checkerSee how your link will look when shared on WhatsApp, X, LinkedIn or Facebook: check the title, description, og:image and Twitter card tags, with fixes.
  • 2.11Subnet calculatorType an IP address with its prefix to get the network, mask, broadcast, usable host range and count, and split it into equal subnets.

╌╌ END ╌╌