Email Header Analyzer — How to Use and Read Results
Use the OpenTrojan Email Header Analyzer to parse From/Reply-To, Received hops and SPF/DKIM/DMARC locally, and spot phishing signals in a message.
Quick Answer
Email Header Analyzer parses From/Reply-To, Received hops and SPF/DKIM/DMARC locally to surface sender spoofing and common phishing signals without sending the message.
Definition
Email Header Analyzer parses an email's headers locally to expose sender identity, mail-auth results and phishing indicators.
What it is
Email Header Analyzer (/tools/email-header/) takes the raw headers of an email and parses them locally — no upload.
How to use
- In your mail client, view the message’s “original”/“raw” source or headers and copy the header block.
- Paste it into
/tools/email-header/. - Read the parsed From / Reply-To / Received hops and SPF, DKIM, DMARC results.
Interpretation
- From ↔ Reply-To mismatch — a common phishing tell; the sender claims one identity but directs replies elsewhere.
- Mail-auth failures (SPF/DKIM/DMARC) — raise the risk, but note that failures can also be misconfiguration.
- Suspicious Received hops — an unusual chain or relayed path can indicate spoofing or open-relay involvement.
Limitations
- Parsing is local and deterministic; headers can be forged upstream, so treat results as signals.
- Mail-auth results depend on the authentic DNS records at sending time; a single fail is not proof of phishing.
Privacy
Headers are analyzed entirely in the browser — the message never leaves your machine, so no raw header enters URLs, history or the network.
Next steps
- Deeper header reading → Analyze email headers for security.
- Full phishing triage → Phishing email investigation playbook.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.