Email header analyzer: is this email real?

Got an email from your “bank”, SARS, a courier or your boss and not sure it’s real? Paste the email’s headers below and press Analyze. FernTool shows who really sent it, whether it passed the anti-fake checks, where replies go, and the route it took to reach you. Nothing you paste is stored.

Don’t know where to find them? Gmail: ⋮ → Show original. Outlook: ⋯ → View → View message details. Full steps: how to view email headers.

What the analyzer checks

• SPF, DKIM and DMARC results added by your own email provider when the email arrived. DMARC “pass” is the strongest proof the email really came from the domain in the From line.
• Reply-To tricks: the email says it’s from one company, but your reply goes to a different (often Gmail) address.
• Fake names: a sender name like “FNB Alerts” or “SARS eFiling” on an address that isn’t the bank’s or SARS’s real domain, or a company name on a free email account.
• Return-Path and signing domain: who handles bounces and who signed the message (often a mailing service, which is normal).
• The route: every server the email passed through, with the delay at each hop (handy when an email “arrived late”).
• The sending server’s IP, its network and country on a map.

How to read the result

“Really came from …” means the domain is genuine. Now check the domain itself: fnb.co.za is the bank, fnb-alerts-secure.com is not, even if it passes every check. “Couldn’t confirm the sender” means the domain isn’t protected or results are missing; don’t trust links or payment requests in it. “Warning signs”: don’t reply, don’t click, don’t pay. If it claims to be your bank, phone the number on the back of your card.

Common fake-email patterns

1. Invoice or banking-details change (“our account has changed, pay here”): very common in South African business email scams. Always confirm by phone using a number you already have.
2. Fake delivery fees from “DHL”, “the Post Office” or “Courier Guy”.
3. Account suspended / verify now emails from “Microsoft 365”, “Netflix” or a bank.
4. The boss in a hurry asking for gift cards or an urgent payment, from a free email address.

Honest limits

Headers show where an email came from, not whether its links or attachments are safe; use the website legit checker for links. Big providers (Gmail, Outlook) hide the sender’s personal IP, so the location is usually the provider’s server, not the person. Lines at the bottom of the headers can be faked by the sender; the results your own provider added at the top can’t.

Frequently asked questions

How do I see the full headers of an email?

In Gmail on a computer, open the email, click the three dots next to Reply and choose “Show original”, then “Copy to clipboard”. In Outlook on the web, Outlook.com or the new Outlook for Windows, open the email, click the three dots (More actions), then View → View message details. In the Outlook desktop app, open the email and choose File → Properties and copy the “Internet headers” box. On a phone it’s easiest to forward the email to yourself and open it on a computer.

Can email headers be faked?

Partly. Anyone can type a fake From name and address, and a scammer can add fake Received lines at the bottom. What they can’t fake are the lines your own email provider adds when the email arrives: the top Received lines and the Authentication-Results line with SPF, DKIM and DMARC. That’s why this tool trusts those results most.

What do SPF, DKIM and DMARC “pass” mean?

SPF pass means the server that sent the email is allowed to send for that domain. DKIM pass means the email carries a valid digital signature and wasn’t changed on the way. DMARC pass means one of those checks matched the domain in the From address you see, so the email really came from that domain.

The email passed every check. Is it safe?

It means the email really came from the domain in the From address. It doesn’t prove the domain is honest: scammers can register look-alike domains (like fnb-alerts.co) and pass every check. Look closely at the domain itself, and paste any link into the website legit checker before clicking.

Can I find someone’s location from an email header?

Only roughly, and usually not at all. Big providers like Gmail and Outlook hide the sender’s own IP address, so you see Google’s or Microsoft’s server instead. When an IP is visible it usually belongs to a company mail server or an internet provider, which gives a country and network, not a street address.

Related tools and guides

• How to view full email headers in Gmail, Outlook, Apple Mail and Yahoo
• SPF & DMARC checker (can scammers fake email from a domain?)
• Is this website legit? (check links from the email)
• Where does this link go?
• How to spot WhatsApp, SMS and email scams
• Been scammed? What to do now
• Why are my emails going to spam?
• IP address lookup
• WHOIS lookup (who owns a domain?)

API: POST /api/email-headers with JSON {"headers":"..."} · MCP tool analyze_email_headers.