Analyse an email's headers
The name your mail client displays is declarative : anyone can write what they like in the « From » field. The technical headers, by contrast, record every server the message passed through, newest first. You read them from the bottom up, and the three lines that settle the matter are the SPF, DKIM and DMARC authentication results.
The tools, in order
- 01MxToolboxfree
Lays the headers out flat, server by server, with each authentication verdict
Email deliverability diagnostics tool that checks MX records, SPF, DKIM, DMARC configuration, and server health to prevent email delivery issues.
- 02EmailRepfreemium
Gives the sending address's reputation and its apparent age
Email address reputation and intelligence lookup. Determine if an email is suspicious, associated with malicious activity, spam or data breaches. API available.
- 03
Says whether the sending domain is a disposable address service, which changes everything
Searchable registry of disposable email domains with bulk download support for threat intelligence integration.
- 04ViewDNS.infofree
Checks who owns the sending server and how long the domain has existed
Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.
- 05urlscan.iofree
Opens the message's links for you, revealing neither your address nor your browser
Free URL and website scanner that takes screenshots, extracts all resources loaded, DOM structure, network connections, and links — ideal for analyzing phishing pages safely.
The pitfall to avoid
The oldest IP address in the headers is not necessarily the sender's. A message routed through a sending service, a mailing list or a corporate relay carries the relay's address. And headers can be forged : only the lines added by a server you consider trustworthy are authoritative.
🧭 The full plan
The copilot orders every step from your starting point, with pre-filled queries.
📖 The guides
Detailed methods by investigation type.