Free tool · by AlphaIT
Is This Email Fake? Free Email Header Checker
Paste the headers of a suspicious email and see who really sent it: whether it passed sender checks, whether the address is a look-alike, and where your reply would actually go.
Step one
How to Copy an Email’s Headers
Headers are the hidden lines at the top of every email that record where it came from. Phone mail apps don’t show them, so use a computer or the web version of your email.
New Outlook and Outlook on the web
Open the email, select More actions (…) at the top of the message, then View › View message details. Select all the text, copy it and paste it above.
Classic Outlook for Windows
Double-click the email so it opens in its own window. Click File › Properties. Copy everything in the Internet headers box.
Gmail
Open the email. Next to Reply, click More › Show original. Click Copy to clipboard and paste it above. The message text is ignored.
Apple Mail on a Mac
Open the email and choose View › Message › All Headers (or Raw Source). Copy the header lines and paste them above.
What the checker looks for
Six Signs That Give a Fake Email Away
Scammers can copy a logo and a signature in seconds. The headers are much harder to fake, because your own mail server writes part of them.
Failed sender checks
Your mail server records whether the message passed SPF, DKIM and DMARC for the domain in the From line. A real bank or supplier should pass.
A name that hides the address
A display name like “Microsoft 365 Support” or “ceo@yourcompany.ca” sitting on top of a completely different address.
Look-alike domains
Swapped letters such as rn for m or 1 for l, an extra word (microsoft-support.com), or a different ending. Add your own domain to catch copies of it.
Replies that go elsewhere
A Reply-To address at Gmail or another domain, so your answer goes straight to the scammer.
Free accounts with official titles
“Payroll”, “Accounts” or “IT Help Desk” writing from a personal Gmail or Outlook.com account.
Throwaway Microsoft 365 tenants
Mail from a default something.onmicrosoft.com address, which attackers set up with free trials.
Know the limits
A Clean Result Doesn’t Mean the Email Is Safe
When a real supplier’s or colleague’s mailbox is hacked, the scam comes from their genuine account and passes every check. That’s how a lot of invoice and payroll fraud works, and no header tool can catch it.
So use one rule for anything involving money, passwords or banking details: confirm it by phone, using a number you already have, not one in the email.
Frequently asked questions
Fake Email Checker FAQs
What people ask when an email doesn’t feel right.
How can I tell if an email is fake?
Look past the logo and the display name. Check the real sender address, whether it passed SPF, DKIM and DMARC, whether the domain is a look-alike, and where replies go. This tool reads all of that from the headers. For anything involving money or passwords, also confirm by phone.
Is it safe to paste email headers here?
Yes. The check runs in your browser and nothing is uploaded. Headers contain addresses and server names, not the message text or attachments. Gmail’s “Show original” includes the message too, but the tool only reads the header lines.
Can I check an email on my phone?
Most phone mail apps don’t show headers. Open the same email in Outlook on the web or Gmail in a browser on a computer, copy the headers there, and paste them here.
What does “DMARC fail” mean?
The message claims to be from a domain but couldn’t prove it, either because it came from a server that domain doesn’t authorise or because its signature didn’t match. Real email from a well-run company passes.
The email passed every check. Is it real?
It really came from that domain, but that doesn’t make it safe. Check the domain is the company you expect, and remember that a hacked real mailbox passes all checks. If it asks for money or a change of banking details, phone the sender.
I already clicked the link or replied. What now?
Act quickly. Change the password for the account you entered, from a different device if possible, and make sure multifactor authentication is on. Tell your IT provider. If you paid money, call your bank right away and report it to the Canadian Anti-Fraud Centre. Our phishing emergency guide puts these steps in order for your situation.
Where do I report a phishing email in Canada?
Use the Report or Report phishing button in Outlook or Gmail, tell your IT provider, and report fraud to the Canadian Anti-Fraud Centre.
Can scammers send email that looks like it’s from my company?
If your domain doesn’t have DMARC set to quarantine or reject, yes. Check yours with our free email security checker.
Phishing protection for your office
Tired of Guessing Which Emails Are Real?
We set up email filtering, multifactor authentication and sender verification for Edmonton offices, and staff can forward anything suspicious to us.
780-318-0149
Edmonton, AB · serving the Edmonton region