Paste the full header of the message
The analyzer needs JavaScript. The page below explains how to read a header by hand: the Received lines from the bottom up, then the From, Reply-To and Return-Path fields, then the Authentication-Results field.
How to get the full header
In Gmail on a browser, open the message, choose More next to Reply, then Show original, and Copy to clipboard. In classic Outlook for Windows, open the message in its own window and choose File, then Properties: the header is in the Internet headers box, where it can be selected and copied. In the new Outlook, choose More actions at the top of the message, then View, then View message details. Other mail programs have a similar command, usually called View source, Show original or View full headers.
What the analyzer reads and what it does not prove
The format of a message header is set by RFC 5322. A message carries trace fields: an optional Return-Path field and one or more Received fields, each added at the top of the message by a server that handles it. The standard calls the trace fields strictly informational, and a Received line written by a sender’s own system is only the sender’s statement about itself. For this reason the analyzer lists the lines in the order they were added and marks the top one, written by the receiving system, as the line to rely on.
The Authentication-Results field, described in RFC 8601, records what the receiving system found when it checked the message: SPF, DKIM and DMARC are the methods most often listed, and each result is one of a fixed set, such as pass, fail, softfail, neutral, none, temperror or permerror. The standard warns that the field often has no integrity check of its own, so it has to be trusted implicitly, and that valid use requires a receiving system to remove any such field that claims to come from its own domain when the message enters. An Authentication-Results field that sits below the top one, or that names a server that is not the recipient’s own provider, may have been written by anyone.
What the analyzer cannot do is as important. It does not look up an address or a domain, so it cannot tell who owns an IP address or where a server is. It does not decide that a message is genuine or false: a pass on all three checks only says that the message matches the domain it claims, and a fraudster can set up such a domain. The page on tracing an e-mail sender describes what a header can show in an investigation, and the certificate that must go with an e-mail produced in court is on the page on section 63 of the BSA.
If the message is part of a fraud
Keep the original message with its full header and do not delete it. Report the matter on cybercrime.gov.in or call 1930; if money has been paid, tell the bank first, as the page on a UPI fraud complaint explains.
Frequently asked questions
How do I read an e-mail header?
Read the Received lines from the bottom to the top. Each mail server that handles a message adds a Received line above the ones already there, so the lowest line is the first hop and the top one is the server that delivered the message to the recipient. The analyzer on this page sorts them in that order, gives the time of each hop and the delay between hops, and lists the addresses it finds in them.
What is the difference between From, Reply-To and Return-Path?
The From field names the author of the message and is the address most mail programs show. The Reply-To field, where it is present, is the address the author suggests for replies; without it, replies go to the From address. The Return-Path field is added at delivery and holds the address that bounces go to. The three can legitimately differ, for example when a mailing service sends on behalf of a business, and a difference is a reason to look closer, not proof of fraud.
What do SPF, DKIM and DMARC results mean?
They are the results that the receiving mail system records in the Authentication-Results field. SPF checks whether the sending server is allowed to send for the domain, DKIM checks a signature on the message made with a key published by the signing domain, and DMARC checks that one of the two matches the domain in the From field. A pass says the check succeeded. It does not say that the message is honest, because a fraudster can register a domain and set all three up for it.
Can the Received lines be forged?
Yes, those below the line added by your own mail provider. A server that sends a message can put any text it likes in the lines it writes and in the lines it has before it passes the message on. Only the lines added by the servers of the recipient’s own provider are written by a system that the recipient’s side controls, which is why the analyzer marks the top Received line and the top Authentication-Results line as the ones to rely on.
Is the header I paste sent anywhere?
No. The analysis runs in the browser and the text is not uploaded. The page does not look up any address or domain either, so a result such as “private address” comes from the form of the address and not from a query.
What should I do if the header shows a fraudulent e-mail?
Keep the original message and its full header, do not delete it, and report the matter on cybercrime.gov.in or call 1930. The header is part of the evidence, and the page on tracing an e-mail sender explains what it can and cannot show.