Parse and analyze email headers to trace message routing, verify SPF/DKIM/DMARC authentication, and detect spoofing.
Paste a complete raw email header to map the message's recorded delivery path and inspect its authentication evidence. The analyzer identifies Received hops, sender-related fields, SPF and DMARC verdicts, and DKIM signing domains, then exposes mismatches that can indicate impersonation. The common surprise is that the visible From address is not necessarily the identity checked by SPF or signed by DKIM. DMARC connects those identities through domain alignment, so an isolated pass or fail can be misleading.
The analyzer parses the header fields and separates the Received entries into routing hops. Mail servers normally prepend new Received fields, so the earliest recorded hop is usually at the bottom of the header and the latest is at the top. Hostnames, IP addresses, timestamps, and apparent delays help reveal an unexpected relay or an internally inconsistent route.
SPF relates the connecting server to an envelope-sender domain, while DKIM associates a valid signature with the domain named by its d= tag. DMARC evaluates whether an authenticated SPF or DKIM domain aligns with the visible From domain. The analyzer brings these identities and recorded verdicts together so that a pass under an unrelated domain is not mistaken for aligned authentication.
No. A pass shows that a particular authentication or alignment test succeeded for the identities shown in the header. An attacker can send authenticated mail from a domain they control, and a compromised account can produce valid authentication. Review the actual domains, Reply-To destination, route, and message context rather than treating any single pass as a safety verdict.
The checks evaluate different evidence. SPF depends on the connecting IP address and envelope-sender domain, DKIM depends on a signature surviving content changes, and DMARC depends on alignment with the visible From domain. Forwarding, mailing-list modifications, multiple signatures, or results recorded by different receivers can therefore produce mixed outcomes. Missing historical DNS or transport context may prevent a definitive reconstruction.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.