Email & Website Security·Updated 2026-10-21

How do I read email headers to check if a message is fake?

Short answer

Open the full message source and look at the Authentication-Results line for SPF, DKIM and DMARC results, compare the From, Reply-To and Return-Path addresses, and read the Received lines from bottom to top to see where the message really came from.

The details

A DMARC pass for the visible From domain is a strong sign the message was sent by that domain’s authorized servers. A Reply-To address on a different domain is a common sign of invoice fraud. A header analyzer can parse this for you without sending the message anywhere.

Useful next reads and tools

Phishing Email Header Analyzer · tool
Deep Analysis of a Weaponized HTML Phishing Attachment · lab

Terms explained

DMARC: DMARC is a DNS policy that tells receiving mail servers what to do with email that fails SPF and DKIM alignment for your domain, and where to send reports about it.
Business email compromise: Business email compromise (BEC) is fraud in which a criminal impersonates or takes over a trusted email account to trick an organization into sending money or sensitive data.
DKIM: DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify it came from an authorized sender for the domain and was not altered in transit.
SPF: SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for a domain.

Sources

DMARC.org Overview