Is this email really from who it says?
Paste the original headers of a message. We read the verdict your own mail provider stamped on it when it arrived — the one part a scammer can’t write for you.
How the check works
When an email reaches your inbox, your provider — Gmail, Outlook, Yahoo, your company server — runs three tests and writes the results at the very top of the message. Every server adds its lines above the ones already there, so that top line is the only one the sender couldn’t have written.
Plenty of checkers search the whole message for the words “spf=pass”. A scammer only has to type those words into the email to fool them. This one reads your provider’s line, confirms it belongs to a server that delivered the message, and ignores everything below it.
- SPF
- Which servers may send for a domain. The domain publishes a list; your provider checks whether the sending server is on it.
- DKIM
- A tamper-proof signature. The sender signs the message with a private key. If anything changes on the way, the signature breaks.
- DMARC
- Does it match the name you see? SPF and DKIM can pass for any domain. DMARC requires one of them to match the From address — and tells providers to reject fakes.
Questions
Is it safe to paste my email here?
Yes. The headers are checked in memory and thrown away as soon as you get your result. Nothing is saved, logged or shared. You can also remove the message body before pasting — only the headers matter.
What does it mean if an email passes?
It means the domain in the From address really sent it, and the message was not changed on the way. It does not mean the content is safe: a real account can be hacked, and a scammer can send perfectly authentic mail from their own look-alike domain. Always read the sender address carefully.
Why does a fake email sometimes say "spf=pass"?
Because anyone can type "spf=pass" into an email. Scammers add fake authentication lines to their messages to fool tools that search the whole text. This checker only reads the result your own mail provider wrote at the top of the message when it arrived, and ignores everything below it.
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send mail for a domain. DKIM is a digital signature that proves the message was not altered. DMARC ties both to the address you actually see in the From line and tells providers what to do with fakes. DMARC is the one that matters most when you want to know who sent a message.
Can I check my own domain?
Yes. Use "Check a domain" to see whether your domain publishes SPF, DMARC and DKIM, how strict the policy is, and what to change so nobody can send email pretending to be you.