Email Header Analyzer: Spot Spoofed Senders in 5 Minutes

When a suspicious email lands, the body can lie. Headers usually don’t.

If your team gets vendor invoice scams, fake password reset notices, or “CEO urgent request” emails, header analysis is the fastest way to separate real mail from spoofed garbage.

What to Check First

SPF Result warn if softfail

Confirms whether the sending server is authorized for that domain.

DKIM Signature fail = high risk

Validates message integrity and sending identity linkage.

DMARC Alignment

Checks if From domain aligns correctly with SPF/DKIM passing domains.

Reply-To mismatch

If display name looks legit but reply path points elsewhere, assume phishing until proven otherwise.

5-Minute Triage Workflow

Export full raw headers from your mail provider
Run analyzer and inspect SPF/DKIM/DMARC results
Compare visible sender vs envelope sender vs reply-to
Review originating IP reputation
If suspicious, block sender/domain and alert staff

Starter command:

python3 edgeiq-email-header-analyzer.py --file suspicious-header.txt

Need help building anti-phishing guardrails for your team?

Get an Email Security Review →