Skip to content
Solvex Space

Cybersecurity · free, no signup

Email Header Forensics

Paste the raw headers of a message someone received and see what the receiving infrastructure observed — not what the sending domain publishes, which is the Email Spoof Checker's job. Its sharpest finding is a duplicate From header: RFC 5322 permits exactly one, mail clients disagree about which of two to display, and that disagreement is the attack rather than a side effect of it. It also catches display names that are themselves an email address belonging to somebody else, reconstructs the Received chain oldest-first so the delivery path reads in the order events happened, and separates the four identities readers assume are one — header From, envelope Return-Path, DKIM signing domain and Reply-To. Every conclusion drawn from Authentication-Results is marked as the receiver's report rather than an observation, because nothing here re-verifies a signature or queries DNS.

Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.

Paste the raw headers of a message you received and see what the receiving server actually recorded — duplicate From headers (which no legitimate path produces, and which exist so your client shows one sender while the message authenticated as another), display names that are themselves somebody else's email address, and the four identities most readers assume are one.

This reports what the receiver observed for one message. What the sending domain publishes is a different question, answered by the Email Spoof Checker. Nothing is re-verified here: no DNS lookup, no signature check — so a missing Authentication-Results header means unknown, never passing.

Gmail: "Show original". Outlook: "View message source". Paste from the first header down to the blank line.

What happens to what you enter

  • The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
  • Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
  • An email address is stored only where a tool offers to send you a report and you choose to give one.

Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.

When a free check is not enough

This tool reads what is public and reports what it can see. The Email Security Hardening (SPF/DKIM/DMARC) engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.

Explore Email Security Hardening (SPF/DKIM/DMARC)
Email Header Forensics — Solvex Space