~/tools $ ./mailtrace

Email Header Analyzer

Trace a message's route, read SPF, DKIM, and DMARC verdicts, and spot the signs of spoofing and phishing.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Raw message headers

Summary

Findings

Route (oldest hop first)

Reading the route

Every mail server that handles a message adds a Received header to the top. Read them bottom to top to follow the message from its origin. Only the hops added by servers you trust, your own provider's, are reliable. Anything below them could have been written by the sender.

SPF, DKIM, and DMARC

SPF checks that the sending IP is allowed to send for the envelope domain. DKIM checks a cryptographic signature over the message. DMARC ties them to the visible From address and tells receivers what to do on failure. Run the sender's domain through the DNS lookup to see its published policies.