TIDY DESK DIGITAL · FREE TOOL · 2.2
Email Header Checker
Read the checks reported in an email's delivery details. See whether replies go to a different domain. Pasted headers are not uploaded or saved.
1. Paste headers
In Gmail, open the message, choose More next to Reply, then Show original. In Outlook, use View message details or Internet headers (the option varies by version). Paste the headers, not the message body. They can contain personal details. This tool reads them on this device only.
No header upload, saved copy or lookup of email records. Hosted page visits are counted as described in the footer. This tool does not check cryptographic signatures itself.
Advanced: select one reported result
Ask your email provider or the person managing your email which report their service added, and how they remove fake copies supplied by outside senders. If you cannot establish that, leave the headers unverified. Selecting a matching service name does not prove who added the report.
Names used in the reports
A domain is the website-style part after @ in an email address, for example example.com.
- SPF: a reported check of whether the sending computer is allowed to send for the address used during delivery. That address can differ from the visible sender.
- DKIM: a reported check of a cryptographic mark called a signature, added by a sending service. It relates to signed parts of the email, not whether its requests are honest.
- DMARC: a reported check of whether a passing SPF or DKIM result matches the visible sender's domain under the matching rules.
- From: the sender address shown in the email. Reply-To: where replies are directed. Return-Path: the address recorded for delivery failures. Different domains are a reason to check, not proof of fraud.
These names and exact report values are kept so you can compare this view with the original email. The tool cannot prove a report is genuine.
What this tool cannot tell you
It reads reported results only. It does not run the checks itself or decide whether links, attachments or a sender are safe. Text after the first empty line is treated as the message and ignored. Missing details, conflicting reports and formats this tool cannot read need a person to review them.
It can read one conventional email address using supported letters, digits and punctuation. It cannot resolve address groups, several addresses together, an address with a quoted part before @, international characters, or a network address in square brackets instead of a website-style name. Other reports named ARC and Received-SPF are not used in place of Authentication-Results.
SPF or DKIM can fail on genuine mail. A DMARC pass may rely on the other check matching the visible sender's domain; this tool cannot verify that match. A dishonest sender can pass checks for a domain they own.
Reference: RFC 8601 (the published internet standard for these reports), especially sections 1.6, 2.5 and 7.