How to Tell if an Email Is Fake - Check SPF, DKIM & Headers

📨Free Email Header Analyzer
Check SPF/DKIM/DMARC results and the real sender path.Open tool →

Quick red flags

Urgent payment or bank-detail changes, a Reply-To address at a different domain (often Gmail), slightly misspelled sender domains, and links that don't match the company.

Open the headers

Gmail: open the email > three dots > Show original. Outlook: open the email > File > Properties > Internet headers. Copy everything.

Read them in seconds

Paste the headers into the Email Header Analyzer. It shows SPF, DKIM and DMARC results, the From, Reply-To and Return-Path addresses, and every server the message passed through, with warnings for common spoofing patterns.

What the results mean

SPF/DKIM/DMARC 'fail' means the message wasn't authorised by the domain it claims to come from – treat it as fake. 'pass' means the domain is genuine, but a real account can still be hacked, so verify unusual requests by phone.

Frequently asked questions

Can a fake email pass DMARC?

Only if it really comes from that domain – for example from a hacked account.

How do I stop people faking my domain?

Set up SPF, DKIM and DMARC – check yours with the Email Spoofing Checker.

Is pasting headers safe?

Yes, they're analysed in your browser.