Where did this email really come from?
Where did this email really come from?
Paste an email’s original message (its headers) and we’ll show the real sending server, its country and network, and whether the sender checks passed.
1. Copy the original message
Pick your email app. You need the whole original message, or at least all the header lines at the top.
- Open gmail.com in a browser and open the email.
- Next to Reply, click the ⋮ (More) button, then Show original.
- A new tab opens. Click Copy to clipboard.
- Come back here and paste it into the box below.
Common questions
What are email headers?
Every email carries hidden lines at the top that record each server it passed through and the results of the sender checks your provider ran. Your email app hides them, but you can copy them using the steps above.
Can this show the person’s home location?
Usually not. If someone sends from Gmail, Outlook, Yahoo or similar webmail, the email leaves from the provider’s servers, so their own IP address is hidden. We tell you when that’s the case. Emails sent from a company’s own server or a home connection can show that network and its country.
What do SPF, DKIM and DMARC mean?
They’re checks your email provider runs to confirm an email really came from the domain in the From address. A pass means the domain’s mail system sent it. A fail means the domain didn’t confirm it.
Is it safe to paste an email here?
Only the header lines are sent. The message itself is removed on your device before anything is sent, and we don’t save what you paste.
Want to check the address itself for data leaks? Use the email check.