← All tools
CYBER SECURITY · EMAIL FORENSICS

Email Header Analyser

Investigate sender identity, authentication results and message routing. Enrich findings with live DNS intelligence without uploading headers to Ingenix.

Only the header section of a selected message is analysed. Everything is parsed locally; when DNS intelligence is enabled, extracted domain names and record types are sent to Cloudflare DNS-over-HTTPS. Message content is never uploaded.

What this tool checks

AuthenticationInterpret SPF, DKIM, DMARC and ARC results recorded in Authentication-Results headers. These are evidence, not independently verified claims.
Delivery routeReconstruct Received hops, display timestamps and highlight gaps or unusual ordering without assuming every header is trustworthy.
DNS intelligenceInspect current SPF, DMARC, DKIM, MX, PTR, MTA-STS and TLS reporting records where relevant and available.
Sender identityCompare From, Reply-To, Return-Path, Sender and Message-ID domains for mismatches that merit review.

A suspicious indicator is not proof of phishing, and a clean result does not prove a message is safe. Current DNS records may differ from those present when the message was received. DNS lookups disclose queried names to the selected resolver.