Is This Email Real?
Paste the headers from a suspicious email to see who really sent it and whether it passed the security checks
Everything happens right here in your browser. The headers you paste are never sent to us or anyone else.
1 Copy the email’s headers
Every email carries hidden “headers”: a behind-the-scenes record of where it really came from. Pick your email app for simple steps:
Outlook (new Outlook, or Outlook on the web)
- Open the suspicious email.
- Click the three dots (…) at the top right of the message.
- Choose View, then View message details.
- Click inside the box that opens. Press Ctrl+A to select everything, then Ctrl+C to copy.
Outlook (classic desktop app, the one with a File menu)
- Double-click the email so it opens in its own window.
- Click File, then Properties.
- At the bottom, find the box labeled Internet headers.
- Click inside that box. Press Ctrl+A to select everything, then Ctrl+C to copy.
Gmail
- Open the suspicious email.
- Click the three dots (⋮) next to the Reply arrow, at the top right of the message.
- Choose Show original. A new tab opens.
- Click the Copy to clipboard button.
Apple Mail (Mac)
- Click the suspicious email to select it.
- In the menu bar at the top of the screen, choose View, then Message, then Raw Source.
- Press Command+A to select everything, then Command+C to copy.
Yahoo Mail
- Open the suspicious email.
- Click the three dots (More) in the toolbar above the message.
- Choose View raw message. A new tab opens.
- Press Ctrl+A to select everything, then Ctrl+C to copy.
On a phone or tablet
Most phone and tablet email apps can’t show headers. Open the same email on a computer, either in your email app or by signing in to your email in a web browser (like outlook.com or gmail.com), and follow the steps above.
Important: copy the headers from the original email. If you forward it to yourself first, the original headers are replaced with yours.
2 Paste them here
Other Signs of a Scam Email
Headers can’t catch everything. Watch for these too.
Urgency and Pressure
“Your account will be closed today” or “I need this wire sent in the next hour.” Scammers rush you so you don’t stop to think.
Look-Alike Addresses
Check the actual address, not just the name: micros0ft-support.com or yourbank-secure.net are not the real thing.
Requests for Passwords or Payment
Real companies don’t ask for your password by email, and a sudden change to payment details should always be confirmed by phone.
Common Questions
What are email headers?
Think of them as the postmarks and tracking stamps on an envelope. Every server that handles an email adds a line, and the receiving server records whether the message passed its security checks. You don’t normally see them, but they tell the real story of where an email came from.
If an email passes every check, is it safe?
Not necessarily. Passing proves the email really came from the domain shown, not that the sender is honest. Scammers can register their own look-alike domains that pass every check, and real accounts sometimes get hacked. Always look closely at the domain, and confirm unusual requests by phone.
Is it safe to paste headers here?
Yes. The analysis runs entirely in your browser and nothing is uploaded. Headers can include names and email addresses, so we made sure they never leave your device.
I found a fake email. What should I do?
Don’t click anything in it. Use your email’s Report phishing or Report junk button, then delete it. If you already clicked a link or entered a password, change that password right away and get in touch with us.
