Paste an email's headers to see whether it really came from who it claims, every server it passed through, where it was sent from, and the warning signs of phishing.
Outlook .msg files cannot be read here: open the message and copy the Internet headers as above. Saved .eml files can be opened directly.
Only the headers were analysed. The message body was ignored and never left your device.
DMARC passes only if SPF or DKIM passed for a domain that belongs to the same organisation as the From address. A pass for a different domain proves nothing about the visible sender.
This page cannot check signatures itself, because that needs the sender's public key from DNS. The pass or fail results above come from the receiving server, which did that check.
Oldest first: hop 1 is the closest to the sender, the last hop is your own mail provider. Hops recorded by your provider are reliable. Hops before it, above the dashed line, were written by the sender's side and could be invented.
Lookup links open another website, which will see the IP address or domain you look up. Nothing is sent unless you click.
The page also carries a content security policy that blocks it from contacting any server. Only lookup links you click open other sites.
SPF checks whether the sending server is allowed to send for a domain. DKIM is a signature proving a domain sent the message and that it was not altered. DMARC ties them to the From address you see: it passes only if SPF or DKIM passed for a domain matching the From domain, and tells receivers what to do if not.
You can reliably find the server that handed the message to your provider. The sender's own device IP appears only when their mail service adds it, for example in an X-Originating-IP header. Gmail and Outlook.com usually do not, so in those cases you see Google's or Microsoft's servers instead.
Partly. Anything the sender writes can be faked, including the From address and the lower Received lines. The lines your own provider adds, at the top, cannot be faked by the sender. That is why this tool marks where your provider took over.
Not necessarily. Passing checks prove which domain sent it, not that the domain is honest: criminals can register their own domains and pass every check. Look at who the domain belongs to, and confirm unexpected requests for money or passwords through a channel you already trust.
Mailing lists, forwarding and marketing services change messages or send on a company's behalf, which can break signatures or produce mismatched addresses. Warnings are reasons to look closer, not proof of fraud.