Email Header Analyzer

How to read this. Start with the Authentication card — if SPF + DKIM + DMARC all pass, the message is almost certainly from the sender it claims to be. If DMARC is fail or none and the From domain is one a phisher might impersonate, treat the message as suspicious. The hop chain tells you the route the email took; a legitimate transactional email usually goes through 1-3 hops from a recognisable sending platform (sendgrid, mailgun, amazonses, gsuite). A long chain bouncing through unrelated hosts, or hops with no rDNS / no IP, is a common phish pattern. The Return-Path being different from the From domain is normal for newsletters (bounces go to a separate domain) but anomalous for a personal email.