MSRXTools / Phishing & email
Email header analyser
Paste a suspicious email's headers: see who really sent it, whether SPF, DKIM and DMARC passed, the relay path, and the spoofing tells.
Runs in your browser
Loading tool…
Good to know
- Copy headers from the recipient's mailbox (“Show original” in Gmail, “View message source” in Outlook), not from a forward, which replaces them.
- DMARC pass means the From domain really sent it. Phishing often comes from real look-alike domains that pass everything, so read the domain carefully.
- Report phishing in India at cybercrime.gov.in or 1930, and forward phishing to the impersonated company's abuse address.
Related tools
Email spoofing check (SPF, DMARC, CAA)
Can anyone send mail as your domain? Reads SPF, DMARC and CAA records and explains each in plain words.Suspicious link inspector
Take a link apart before you click: look-alike letters, punycode, IP hosts, hidden user@ tricks, shorteners and risky TLDs.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.
Can anyone send mail as your domain? Reads SPF, DMARC and CAA records and explains each in plain words.Suspicious link inspector
Take a link apart before you click: look-alike letters, punycode, IP hosts, hidden user@ tricks, shorteners and risky TLDs.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.