Email Header Analyzer

Email headers contain metadata about email's journey from sender to recipient: Key header fields: (1) From: Display name and address (easily spoofed!), what user sees in mail client, not authenticated by default. (2) Return-Path: Where bounces go, indicates sending server, often different from "From" in phishing. (3) Received: Chain of mail servers that handled message, timestamped hops from sender to recipient, most reliable for tracing origin. (4) Authentication-Results: SPF/DKIM/DMARC check results, pass/fail for each mechanism, critical for detecting spoofing. (5) Message-ID: Unique identifier for email, format reveals sending system. (6) X-Originating-IP: Original sender's IP address, useful for geolocation and reputation checks. Security value: (1) Detect spoofing - "From" says CEO but Return-Path is suspicious external domain, authentication failures indicate forged sender. (2) Trace origin - Follow "Received" headers backwards to source, identify compromised mail servers, geolocate attacker infrastructure. (3) Identify phishing patterns - Free email services for business emails, mismatched domains, suspicious routing through unexpected countries. (4) Forensic analysis - Incident response investigations, evidence collection, attribution. (5) Validate legitimacy - Verify email came from claimed sender, check authentication pass rates. What attackers manipulate: Display name in "From" (easy), actual "From" address (harder, caught by DMARC), can't manipulate "Received" chain (added by infrastructure), can't forge DKIM signatures without private key. Use cases: Investigate suspicious emails before clicking links, verify wire transfer requests (CEO fraud), analyze phishing campaigns, compliance audits (email retention), troubleshoot delivery issues.