Try it

Click Load sample to see a phishing email taken apart, or paste your own headers.

Open it full screen ›

Why

Reading raw email headers is a big part of phishing triage, and doing it by eye is slow and easy to get wrong. I wanted a tool that lays it all out in seconds.

What it does

Paste the raw headers (Gmail: Show original; Outlook: File › Properties › Internet headers) and it shows:

• The sender's identity, and whether From, Reply-To, and Return-Path actually line up.
• The SPF, DKIM, and DMARC verdicts.
• The hop-by-hop delivery chain in order, with long timing gaps flagged.
• Anything else that looks off.

Everything is parsed locally in the browser, and nothing is sent anywhere, so it's safe to paste headers from real investigations.

The sample

The built-in sample is a classic PayPal lookalike: it comes from paypa1-billing.com (a "1" instead of an "l"), with an SPF softfail, no DKIM signature, a DMARC fail against paypal.com, and a Reply-To pointing at a third domain. Each of those red flags shows up at a glance.