How to find email headers
| Email app | Where to click |
|---|---|
| Gmail | Three dots next to Reply, then Show original, then Copy to clipboard |
| Outlook (desktop) | Open the email, File, Properties, copy "Internet headers" |
| Outlook on the web | Three dots, View, View message source |
| Apple Mail | View, Message, All Headers |
| Thunderbird | View, Message Source (Ctrl+U) |
Signs an email is spoofed
- SPF, DKIM or DMARC show fail or softfail.
- The Reply-To or Return-Path domain differs from the From domain.
- The first "Received" hop comes from an unexpected country or a home connection.
- The display name says a brand, but the address is a free webmail account.
Found a suspicious sender IP? Check it in the Threat Scanner. Got a link in the email? Use the URL Scanner before clicking.
Frequently asked questions
How do I get the full email headers?
Gmail: open the email, click the three dots, then "Show original". Outlook: open the message, then File, Properties, and copy "Internet headers" (in Outlook on the web: three dots, View, View message source). Apple Mail: View, Message, All Headers.
What do SPF, DKIM and DMARC mean?
SPF checks that the sending server is allowed to send for the domain. DKIM checks a cryptographic signature added by the sender. DMARC combines both and tells the receiver what to do when they fail. A "pass" on all three is a strong sign the email really comes from that domain.
Can an email pass SPF and still be phishing?
Yes. Scammers send from their own look-alike domains that pass every check. That is why this tool also compares the From, Reply-To and Return-Path domains and lets you check the sending IP and links.
Are my headers uploaded?
No. The analysis runs entirely in your browser. The headers - which can contain your email address - are never sent to ScanWith.
What does a Reply-To mismatch mean?
The email looks like it comes from one address, but your reply goes somewhere else. It is a classic sign of invoice fraud and CEO-fraud emails.