See where an email really came from, without reading raw headers
Paste the header block from Gmail, Outlook, Zoho or a Shopee notification. You get the hops, the delay that mattered, and the three authentication verdicts in words you can act on.
🔒 100% client-side · zero server upload
Authentication
Delivery path
| # | Handed over by | Received by | Protocol | Timestamp | Delay |
|---|
Who sent it
Things to look at
Malaysian rules & edge cases
An email header is the envelope, not the letter. It records which servers carried the message, when each one received it, and what the receiving server checked. Everything below is read from the pasted text alone.
| Header | What it tells you |
|---|---|
| Received | Every server that handled the message, newest first. The bottom one is where the message entered the internet. |
| Return-Path | Where bounces go — the envelope sender. It is often different from From, and that alone is not a spoof. |
| Authentication-Results | The receiving server's own verdict on SPF, DKIM and DMARC. This tool quotes it, and infers nothing beyond it. |
| Message-ID | A unique id the sending system assigned. Real system notifications almost always carry one. |
| X-Spam-Status | What the receiving filter scored. Yes means the message was already flagged. |
- SPF asks who may send. Is this server allowed to send mail for that domain? A
softfailis the domain saying “suspicious, but not forbidden”, which is why it is reported as a fail with the original word kept beside it. - DKIM asks whether the signature holds. The sending domain signs the message; a fail means the body no longer matches the signature, or the key was never theirs.
- DMARC asks whether the domain's own policy accepts it, and whether the From domain lines up with what SPF or DKIM authenticated. It is the only one of the three that speaks for the name in your inbox.
- A pass is not a promise. A scammer sending from a domain they own passes all three. Authentication proves which domain sent the message, not that the offer is honest.
- Absent means absent. When no header states a verdict the report prints “not stated in these headers”. It never derives DMARC from SPF plus DKIM, because alignment is decided by the receiving server against a policy this page cannot see.
- Forwarding breaks SPF, not DKIM. A forwarded message often shows
spf=failwithdkim=pass. That is normal, and it is the case DMARC was invented for. - Delays come from the timestamps. A negative gap means two servers disagree about the clock, so the page says the delays are approximate instead of printing a negative number.
- Vendors word it differently. Zoho, Google Workspace, Microsoft 365, Exabytes and Shinjiru all add
Authentication-Results; the tool reads the words, not the vendor.
Before and after
Before
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
by mx.zoho.com with ESMTPS id 4Xy2Kq; Tue, 10 Nov 2026 09:14:03 +0800
Received: from [10.0.0.12] (unknown [10.0.0.12])
by mail-sor-f41.google.com with ESMTPSA id 9z8y7x; Tue, 10 Nov 2026 09:14:01 +0800
Authentication-Results: mx.zoho.com; spf=pass smtp.mailfrom=kedaikopi.my;
dkim=pass header.d=kedaikopi.my; dmarc=pass header.from=kedaikopi.my
Return-Path: <sales@kedaikopi.my>
From: "Kedai Kopi Segamat" <sales@kedaikopi.my>
Reply-To: <sales@kedaikopi.my>
Date: Tue, 10 Nov 2026 09:13:55 +0800
Message-ID: <CAJ8x1k2mN4pQ@kedaikopi.my>
Subject: Pesanan #KK-1042 sudah dihantarAfter
2 hops · 2s in transit
AUTHENTICATION (only what these headers state)
SPF pass
DKIM pass
DMARC pass
DELIVERY PATH (newest first)
1. mail-sor-f41.google.com → mx.zoho.com (ESMTPS)
Tue, 10 Nov 2026 09:14:03 +0800 · +2s
2. [10.0.0.12] → mail-sor-f41.google.com (ESMTPSA)
Tue, 10 Nov 2026 09:14:01 +0800
Biggest delay: 2s, between hop 2 (mail-sor-f41.google.com) and hop 1 (mx.zoho.com)
Total transit: 2s
WHO SENT IT
From: sales@kedaikopi.my
Return-Path: sales@kedaikopi.my (matches)
Reply-To: sales@kedaikopi.my (matches)
Message-ID: <CAJ8x1k2mN4pQ@kedaikopi.my>
THINGS TO LOOK AT
- nothing flagged
Analysed in this browser. Nothing was uploaded, and no header was sent anywhere.How it works
- Open the full header in your mail app — Gmail: Show original, Outlook: View › Message details, Zoho: More › Show headers — and copy from the first Received line down to the last header line.
- Paste it into the left box. The report appears on the right: the hops newest-first, the single biggest delay, the total transit time, and the three authentication verdicts.
- Read “Things to look at” first, then press Copy result to keep the report, or switch the format to CSV rows for a spreadsheet.
FAQ
How do I get the header out of Gmail, Outlook or Zoho?
Gmail on the web: open the message, click the three dots, choose “Show original”, then “Copy to clipboard”. Outlook on the web: open the message, click the arrow next to Reply and choose “View” › “Message details”. Outlook desktop: File › Properties › Internet headers. Zoho Mail: the three dots at the top of the message › “Show headers”. On a phone the header is behind the same menu; if the app cannot show it, open the message on a computer.
SPF, DKIM and DMARC all passed — does that mean the email is safe?
No. Authentication proves the message really came from the domain it claims, and that it was not altered on the way. It says nothing about whether the offer inside is honest: a scammer sending from a domain they bought passes all three. Read the verdicts together with the sender address and the content.
Why does it say “not stated in these headers”?
Because no header in the block records that check. Some internal relays add no Authentication-Results at all, and forwarded mail can lose it. The tool reports what is written and refuses to guess — deriving DMARC from SPF and DKIM would be a guess about a policy this page cannot read.
The From and Return-Path are different domains. Is it a spoof?
Not by itself. Mailing lists, bulk senders and marketplaces routinely send with a different envelope sender, which is why the report shows both domains instead of a verdict. It becomes suspicious when the From claims to be a bank, a marketplace or a government agency and DMARC also failed.
Does my email get uploaded anywhere?
No. The page is static JavaScript with no network calls: the header text is parsed in the tab and never leaves it. There is no request to this site, no analytics endpoint and no third-party host, which is also why the tool works with the network switched off.