+90 212 213 27 87 tekur@tekur.net
Tekur Email Header AnalyzerFree security tool
free email security tool

Who really sent this email?

Paste the email's header and see in seconds whether the sender is authenticated, the SPF / DKIM / DMARC results, the servers it passed through and where it was delayed.

Data never leaves your browser No sign-up needed Free to use

Paste the email header

Not sure how to copy the header? Step-by-step guide
Analysis runs on your device and is never sent to a server.
Test your own emails: do they land in spam?Send an email to your personal test address and get a score out of 10 based on SPF, DKIM, DMARC, reverse DNS, blacklists and content checks. Deliverability test → Is your domain's DNS healthy?Name servers, SOA, MX, SPF, DMARC, DKIM, CAA and DNSSEC checks — similar to intoDNS. DNS check →
step-by-step guide

How to copy an email header

Choose your email program. Then just paste the copied text into the box above.

  1. Double-click the suspicious email to open it in its own window.
  2. Click File in the top left, then Properties.
  3. Click into the Internet headers box at the bottom of the window.
  4. Select everything with Ctrl + A and copy it with Ctrl + C.
  5. Paste it into the box on this page and click Analyze.
  1. Open the email and click the … (More actions) button in the top right.
  2. Choose View → View message details.
  3. Select all of the text in the window and copy it.
  4. Paste it into the box on this page and click Analyze.
Menu names can differ slightly between Outlook versions; look for "message details" or "message source".
  1. Open the email and click the ⋮ (More) icon in the top right.
  2. Choose Show original. A new tab opens.
  3. Click Copy to clipboard.
  4. Paste it into the box on this page. (It's fine if the message body comes along; the tool only reads the header.)
  1. Select the email.
  2. Go to View → Message → All Headers (or open the raw source with ⌥ ⌘ U).
  3. Copy the header text and paste it on this page.
  1. Select the email and press Ctrl + U (View → Message Source).
  2. Copy the text in the window that opens.
  3. Paste it into the box on this page.
  1. Most mobile email apps do not show headers.
  2. Open the email on your computer (Outlook, Outlook on the web or Gmail) and follow the steps above.
  3. In an email you are unsure about, do not click links or open attachments; report it to your IT team.
in short

How to read the results

SPF

Is the sending server authorized?

The domain owner lists in DNS which servers may send email on its behalf. Email from a server not on that list fails SPF.

DKIM

Is the signature valid?

The email is digitally signed with the sending domain's private key. If the signature is valid, the email was not altered in transit and really came from that domain.

DMARC

Is the "From" address genuine?

Checks whether the sender address you see matches the domain verified by SPF or DKIM. This is the most important indicator of spoofing.

frequently asked questions

Common questions

Is the information I paste stored anywhere?

No. The entire analysis runs in code inside your browser; the page is configured so that it cannot send data to any server. When you close the page, the pasted text is gone.

If SPF, DKIM and DMARC pass, is the email definitely safe?

No. These checks only confirm that the email came from the domain shown. Attackers can pass them with look-alike domains they registered themselves (e.g. tekur-support.com). Read the sender domain carefully and always confirm unexpected payment or password requests through another channel.

Why do I see a negative delay?

Each server writes the time according to its own clock. If one server's clock is a few seconds ahead or behind, the calculated delay can be negative. This is not a security issue.

I got a warning because "Reply-To" is different. What does that mean?

When you reply, your answer goes to a different address than the one shown as the sender. That can be normal for newsletters and help desks, but redirecting replies to another domain in an email that looks personal is a common phishing technique.

What are values like SCL, BCL and CAT?

They are added by the Microsoft 365 / Exchange Online spam filter. SCL is the spam confidence level (0–1 clean, 5–6 spam, 7–9 high-confidence spam), BCL is the bulk mail level, and CAT is the category the filter assigned (spam, phishing, spoofing, etc.). The tool explains these values automatically in plain English.

Tired of fake emails reaching your company?

Since 1998, Tekur has supported businesses with email security, SPF/DKIM/DMARC configuration, firewall and backup solutions.

Contact us