Tools
Email header analyser.
Paste the full headers of a suspicious email to see whether it passed SPF, DKIM and DMARC, who really sent it, where replies would go and the route it took. It runs in your browser, so the headers never leave your device.
Finding the headers
- Gmail: open the email, choose ⋮ (More) then Show original, and copy the text.
- Outlook: open the email, choose … (More actions), View, then View message details.
- Apple Mail: open the email, then View, Message, All Headers.
Think it's phishing? Forward it to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk, then delete it. Headers can be forged below the point your own mail provider added them, so trust the topmost results most.