Every email carries a hidden travel log. Here is what matters:
Received chain = the journey. Each mail server stamps a Received: line. Reading them bottom-to-top shows the path from the sender's server to your inbox. A "bank" email whose first hop is a random home IP in another country is a forgery.
SPF — is this server allowed to send for the domain? The receiving server checks whether the sending IP is on the domain's approved list. spf=fail means the sender was NOT authorized — a classic spoofing sign.
DKIM — is the message signed & unaltered? A cryptographic signature from the sender's domain. dkim=pass means the message is genuine from that domain and wasn't changed in transit. dkim=none/fail weakens trust.
DMARC — do From and the checks agree? DMARC ties SPF/DKIM to the visible From: domain and tells receivers what to do on failure. dmarc=fail on an email claiming to be from a big brand is a strong phishing indicator.
Reply-To mismatch = reply hijack. If the email claims to be from your bank but Reply-To points to a different, unrelated domain, your reply (and anything you send) goes to the attacker. Always compare it with From.
Return-Path mismatch = bounced identity. The Return-Path is where bounces go. It often differs legitimately (newsletters use sending services), but combined with failed SPF/DMARC it confirms the From address was forged.
🔒 100% private: headers are parsed locally in your browser. Nothing is uploaded, stored or shared.