Header X-Ray
Header X-Ray is a free email header analyser. Paste the full headers of an email to see the route it took, whether it passed SPF, DKIM and DMARC, and whether the sender is who they say they are. Everything happens in your browser.
Try an example:
Private by design: the headers are read on your device. Nothing is uploaded, stored or looked up, and no links or IP addresses are contacted.
How to use it
- Open the email in your inbox and copy its full headers (see below for Gmail, Outlook and Apple Mail).
- Paste them into the box and press Analyse headers (or Ctrl+Enter).
- Read the verdict, then the three authentication cards: SPF, DKIM and DMARC.
- Check the list of findings and the route timeline, which shows every server the message passed through, oldest first, with the delay at each step.
If you enjoy what we do, consider supporting us. Every little bit means the world! Support Catpool on Ko-fi
How to find email headers
Gmail
Open the email, press the three dots ⋮ next to Reply and choose Show original. Press Copy to clipboard, then paste it here. You can paste the whole thing. The tool stops reading at the first blank line, where the message text begins.
Outlook and Microsoft 365
In Outlook on the web, open the email, press … then View → View message details. In the Outlook desktop app on Windows, open the email and go to File → Properties, then copy everything in the Internet headers box.
Apple Mail and iPhone
On a Mac, open the email and choose View → Message → All Headers (or Raw Source). The iPhone Mail app can’t show headers, so forward the email to a computer or open your account in a web browser.
Yahoo and others
Most webmail services have an option called View raw message, Show source or Message source in the menu of an open email.
What SPF, DKIM and DMARC mean
SPF (Sender Policy Framework) is a list the domain owner publishes of the servers allowed to send their email. If the sending server isn’t on the list, SPF fails.
DKIM (DomainKeys Identified Mail) is a digital signature added by the sending server. If anything in the signed parts of the message is changed on the way, or the signature is fake, DKIM fails.
DMARC ties the two together with the address you actually see in the From line. It passes only if SPF or DKIM passed for the same domain as the From address. That’s why DMARC is the most important of the three: an email can pass SPF for a scammer’s own domain while showing your bank’s name in the From line, but it can’t pass DMARC for your bank.
These results are added by your email provider when the message arrives, in a header called Authentication-Results. We read what your provider decided. We don’t look anything up ourselves, which is why the headers have to come from your own inbox.
Reading the route timeline
Every mail server that handles an email adds a Received line to the top of the headers, so they read newest first. The timeline flips them round so you can follow the journey from the sender to you. For each hop you’ll see the server names, the IP address, whether the connection was encrypted, and the time difference from the previous hop.
The first hop with a public IP address is usually the server that really sent the message. Delays of a few seconds are normal. Minutes can mean spam filtering or a busy queue. Times that go backwards mean a server clock is wrong or, occasionally, that a scammer added a fake Received line to make the email look more genuine. Lines added before the message reached a server you trust can be forged, so give the most weight to the lines added by your own provider.
Signs of a spoofed email
- DMARC fails for the domain in the From line.
- The display name contains an email address that differs from the real one, like “PayPal <service@paypal.com>” <alerts@random-domain.top>. Phone mail apps often show only the name.
- A company name sent from Gmail, Outlook.com or another free account.
- Reply-To points somewhere else, so your reply goes to the scammer instead of the company.
- The sender’s domain is a lookalike (paypa1.com, barclays-uk-verify.com).
A mismatched Return-Path or DKIM domain on its own is normal for newsletters sent through mailing services, so the tool marks those as information rather than warnings.
Privacy
The analysis runs entirely in your browser with JavaScript. The headers you paste aren’t uploaded to Catpool or anyone else, aren’t stored, and no IP addresses or domains are contacted. Headers can include your email address and your provider’s internal server names, so it’s good practice not to post them publicly. If you want to share them with someone helping you, remove your address first.
Frequently asked questions
Can this prove an email is genuine?
It can show that a message really came from the domain in the From line. It can’t tell you whether the content is honest: a scammer can register a convincing domain and pass every check for it. Treat any unexpected request for money, passwords or codes with suspicion, whatever the headers say.
Why does it say “not found” for SPF, DKIM or DMARC?
Either the headers were copied without the Authentication-Results line, or your provider doesn’t add one. Copy the full original message again. Some business mail systems remove these headers internally.
The email passed everything but still looks suspicious. Why?
Accounts get hacked. If a real supplier’s or friend’s mailbox is taken over, emails from it pass every check. Look for changed bank details, urgency and unusual requests, and phone the person on a number you already know. Our Email X-Ray can score the message text itself.
Where should I report a phishing email?
In the UK, forward it to report@phishing.gov.uk. The National Cyber Security Centre uses these reports to take scam websites down. Then delete it. If you’ve given away bank details, call your bank on 159.
Related: Catpool home, Security, Email X-Ray, Link X-Ray, Text X-Ray, Website X-Ray.
