Email Header Analyzer, private by default

What raw email headers can tell you

Email headers are the technical envelope around a message. They include routing hops, sender fields, authentication results, mail client details, and identifiers used by mail servers.

Headers do not prove intent by themselves, but they can reveal useful warning signs when a message looks suspicious or when a test email is not arriving as expected.

Sender fields worth comparing

The visible From address is what most people notice first. Reply-To controls where replies go, and Return-Path is often used for bounces. In legitimate email these fields can differ, but unexpected mismatches deserve attention.

For example, a message that claims to be from a bank but sends replies to a free webmail account is a stronger phishing signal than the display name alone.

• From: the visible sender shown by most email clients
• Reply-To: where your reply may be sent
• Return-Path: the bounce address used by mail systems
• Authentication-Results: SPF, DKIM, and DMARC outcomes when a receiving server adds them

Limits of header analysis

A header analyzer is a review tool, not a guarantee. Forwarding, mailing lists, help desks, and CRM systems can create complicated but legitimate headers.

Use header analysis alongside normal safety habits: verify the domain, avoid unexpected attachments, do not paste one-time codes into surprise login pages, and use a password manager to catch fake domains.