Trust beats tactics™

Email forensics

Email Source Analyzer

Headers tell the whole story. Paste the raw source of a message (View Original in Gmail, View Source in Outlook, etc) and we will decode the routing path, authentication results, sender alignment, body structure, and the spam signals that mailbox providers react to.

Need only the headers? Use the Email Header Analyzer instead.

In Gmail: open the message, click the three dots, choose Show original, copy everything. We never store the input.

How this tool works

What we parse from one raw message

  1. 1

    Sender alignment

    From, Reply-To, Return-Path. We flag mismatches between the visible From domain and the bounce or reply paths.

  2. 2

    Authentication results

    SPF, DKIM and DMARC results pulled from Authentication-Results and Received-SPF. None means the receiving server did not check.

  3. 3

    Routing path

    The full hop chain from Received headers, with per-hop server name, IP and delay. Wide gaps between hops are the usual sign of a queue stall.

  4. 4

    Body inspection

    Image count, 1x1 tracking pixels, link count, shortened URLs, hidden text (display:none, font-size:0) and the text-to-HTML ratio.

  5. 5

    Spam indicator rollup

    A weighted score across the auth, sender and body signals. A clean, suspicious or risky rating with the exact reason for each point.

Example readout

  • SPF pass
  • DKIM pass
  • DMARC none

Route

  1. mx.example.net18 minutes
  2. mail.example.com

Rating

  • Clean
  • Suspicious
  • Risky

When to use it

Reach for it in these moments

  • A specific message landed in spam

    Paste the raw source. The authentication and body sections together usually identify the cause.

  • You suspect a phishing attempt

    Mismatched Return-Path, missing Message-ID, hidden text or shortened URLs surface here without any guesswork.

  • You need a forensic readout for an incident report

    The hop chain plus authentication results plus spam rollup is the structure most incident reports need.

Email Almanac

  • Not sure what this means?

    Ask a real person. The Email SOS Hotline is free help with any email problem, no pitch.

    Ask the Email SOS Hotline

  • Keep this result

    Send it to your inbox, to share with your team or compare after a fix.

    Run a check, then email it

  • This reads one message. Your list decides who gets the next one.

    Mailbox providers judge you on who you send to, not only on what one message looks like. Clean your first 1,000 addresses free.

    Clean your first 1,000 free