📧 Email Security Analyzer

Copy the sender name, sender email address, and subject from a suspicious email (don't click anything in it). This educational tool explains the red flags — so you learn the patterns, not just this one email.

⚠️ Ethical Use Only: These tools are for defensive purposes — securing your own accounts and systems. Never use security knowledge against systems you do not own or lack written permission to test.

Sender display name (the "From" name you see)

Sender email address (the real address behind the name)

Subject line

📄 SPF, DKIM & DMARC — in plain English

These are email authentication standards that help prove a message really came from who it claims:

SPF: the domain owner publishes which servers may send their mail. Others get flagged.
DKIM: the sender cryptographically signs the message — tampering breaks the signature.
DMARC: tells receivers what to do when SPF/DKIM fail (quarantine or reject).

You can't check these from the message alone — but reputable providers (Gmail, Outlook) check them automatically and warn you ("couldn't verify sender"). Never ignore those warnings.

🛡️ Email safety habits

Never enable macros or "enable content" in unexpected Office attachments.
Don't download attachments you didn't ask for — even from known senders (their account may be hacked).
Verify requests through a separate channel: call the person/organization on a known number.
Use a phishing URL analyzer mindset on every link: read the real domain before clicking.

About This Tool

What this tool does

The Email Security Analyzer helps you understand whether an email you received is likely legitimate. It explains the email authentication systems that protect inboxes — SPF, DKIM, and DMARC — and guides you through checking the headers and sender details of messages you receive, so you can spot spoofed or forged emails.

Email spoofing is a common attack technique: criminals forge the "From" address to impersonate banks, employers, or government agencies. The analyzer is for anyone who wants to verify a suspicious message about their own inbox — for example, an unexpected "security alert" or invoice — before acting on it.

The tool is educational and defensive. It analyzes messages you received; it does not send email, and it cannot be used to test other people's mail servers or to craft spoofed messages. Analysis happens with the information you paste, and nothing is uploaded to a server.

How to use it

Open the suspicious email in your mail app and find the option to view full headers or the original message.
Look at the authentication results section of the headers for SPF, DKIM, and DMARC results.
Compare the "From" address with the "Return-Path" and the domain in the DKIM signature. Mismatches are a warning sign.
Check whether the sender's domain publishes a DMARC policy — domains with strict policies are harder to spoof.
If the results are unclear or the message asks for sensitive action, contact the supposed sender through a known phone number or website instead of replying to the email.

Defensive security tips

Publish SPF, DKIM, and DMARC for your own domain. If you run a website or business email, these records make it much harder for attackers to impersonate you.
Treat display names with suspicion. The name shown ("Your Bank") is easy to fake; the actual address and authentication results are what matter.
Be careful with attachments and links. Even from familiar senders, unexpected attachments deserve verification — accounts get compromised and used to spread malware.
Use a separate email for important accounts. Keeping banking and recovery email separate from the address you give out publicly reduces your exposure.
Enable 2FA on your email account. Your email is the key to password resets everywhere; protecting it protects everything linked to it.

FAQs

What do SPF, DKIM, and DMARC actually do?

SPF lists which servers may send mail for a domain. DKIM adds a cryptographic signature proving the message was not altered. DMARC tells receiving servers what to do when the first two fail. Together they make spoofing much harder.

If an email passes all checks, is it definitely safe?

Not necessarily. A compromised legitimate account sends mail that passes every check. Authentication proves the message came from that domain's infrastructure — it does not prove the content is honest or the link is safe.

Can I use this to check someone else's email server?

No. This tool is for analyzing messages in your own inbox for your own protection. Testing other people's mail systems without permission is not something these tools support.

What should I do with a confirmed spoofed email?

Delete it, do not click anything in it, and report it to your email provider. If it impersonates a company you use, forward it to that company's published abuse or phishing address.