Free tool
Email header analyzer. See where a message really came from.
Paste the raw headers of an email to see the mail servers it passed through, whether SPF, DKIM and DMARC passed, and whether the From, Reply-To and Return-Path domains line up.
The analysis runs in your browser. The headers you paste are not sent to AntiBait or anyone else.
What it checks
The part of an email you never see.
Every email carries a block of headers above the message. Some are written by the sender (From, Subject, Reply-To), and some by each mail server that handled the message on the way to you (Received, Authentication-Results).
The From line is just text and anyone can type any address into it. The headers your own mail provider adds are much harder to fake: they record which server handed over the message and whether the sending domain vouched for it. Reading them side by side is the quickest way to spot a spoofed sender.
Delivery path
Every Received line, oldest first, with the sending server, its IP address, the protocol and how long each relay held the message.
SPF, DKIM and DMARC
The Authentication-Results header written by your provider, parsed into each check’s result and the domain it was checked for.
Domain alignment
Whether Return-Path, Reply-To, the Message-ID and the DKIM signer belong to the same domain as From.
Obvious mismatches
Replies that go somewhere else, a display name that shows a different address, failed checks, and timestamps that run backwards.
Reading the result
How to read the result.
Findings are sorted from the most serious down. One finding on its own rarely proves anything; several pointing the same way usually do.
- DMARC fail
- The strongest single sign of spoofing. The From domain publishes a policy, and the message met neither of its conditions: no SPF pass and no DKIM signature from that domain.
- SPF and DKIM
- A pass means a domain vouched for the message, not necessarily the domain in From. Check the domain shown next to each result, and the alignment rows.
- Matches From / Differs
- Newsletters and other bulk mail often use a separate Return-Path and DKIM domain for their mailing service, so a difference there is common. A Reply-To on an unrelated domain deserves more suspicion: your answer would go to someone else.
- Delivery path
- Read it top to bottom as the route the message travelled. The hops near the top were written by the sender’s side and can be invented; the last hops are your provider’s and can be trusted.
- Clock skew
- A hop stamped earlier than the one before it. Usually a server with the wrong time, but fabricated Received lines also show it.
Questions
Common questions.
How do I get the full headers of an email?
In Gmail, open the message, choose the three-dot menu and then Show original. In Outlook on the web, open the three-dot menu and choose View, then View message details; in classic Outlook for Windows, open the message and go to File, Properties, Internet headers. In Apple Mail use View, Message, All Headers, and in Thunderbird View, Message Source. Copy everything above the message body.
Is it safe to paste my headers here?
The analysis runs entirely in your browser and nothing you paste is uploaded. Headers can still contain your email address and the names of internal servers, so treat them like any other personal data when you share them elsewhere.
Why are there several Authentication-Results headers?
Every server that checks a message may add one. Only the topmost one was written by your own mail provider. Lower ones may come from the sender’s side, and a forged one claiming that everything passed is a known trick, so this tool bases its verdict on the topmost header.
SPF and DKIM passed, so is the email safe?
Not necessarily. Passing checks prove that a domain sent the message, not that the domain is honest. Attackers register their own domains and set up SPF and DKIM for them. Look at which domain passed, and whether it is the one the email claims to come from.
What if there are no Received headers?
Then you probably copied the headers from a sent message, a draft or a file saved by a mail client, which have no delivery path. Open the message as it arrived in the recipient’s inbox and copy the headers from there.
Full analysis
Not sure about the whole email? Check all of it.
This tool looks at one part of a message. The AntiBait analyzer reads the whole email: sender authentication, links and where they redirect, attachments, the text itself and the sender’s identity, and explains its verdict. You can try it for free, without creating an account.