Phishing Email Checker
Check if an email is phishing — instantly. Paste email headers for free analysis of SPF, DKIM, DMARC authentication, suspicious links, and 15+ threat indicators.
Paste headers below or upload an email file
Copy the full email headers from your email client and paste them above. All analysis runs entirely in your browser. Email files (.eml, .msg) are processed locally and never uploaded to any server.
70+ Checks We Run
Authentication & Trust
Header Forensics
Content Analysis
Attachment & Media
Threat Intelligence
AI-Powered Analysis
* Limited on free tool — full analysis available via API. All heuristic checks run locally in your browser.
Paste Headers
Copy the full email headers from your email client (Gmail, Outlook, Thunderbird, etc.) and paste them into the text area above.
Instant Analysis
The checker parses authentication records (SPF, DKIM, DMARC), traces the email route, extracts IOCs, and detects spoofing patterns.
Get Verdict
Receive a risk score (0-100) with a clear verdict, key findings, and recommended actions based on the analysis.
Our phishing email checker runs 15+ analysis modules against every email to detect threats that simpler tools miss.
SPF / DKIM / DMARC
Validates all three email authentication protocols to verify sender legitimacy and detect spoofing.
ARC Chain Validation
Checks Authenticated Received Chain integrity for forwarded emails.
Homoglyph Detection
Identifies lookalike domains using Unicode characters designed to trick recipients (e.g. paypaı.com).
Link Mismatch Detection
Compares displayed link text against actual URLs to catch deceptive redirects.
Phishing Template Matching
Matches email patterns against known phishing campaign templates and kits.
IOC Extraction
Extracts IPs, domains, URLs, email addresses, and file hashes as indicators of compromise.
HTML Content Analysis
Detects hidden text, tracking pixels, and dangerous HTML elements used in phishing.
OAuth URL Detection
Identifies consent phishing attacks that abuse OAuth authorization flows to steal access.
Form Action Analysis
Analyzes embedded HTML forms for credential harvesting attempts.
CSS Cloaking Detection
Identifies CSS techniques used to hide malicious content from users.
Thread Hijacking
Detects reply-chain attacks where attackers inject messages into existing conversations.
RFC 5322 Compliance
Checks email headers against RFC standards to identify forged or malformed messages.
Attachment Analysis
Assesses attachment risk based on file types, double extensions, and embedded macros.
QR Code Phishing
Detects QR codes in emails that redirect to phishing sites (quishing attacks).
Writing Style Analysis
Identifies stylometric anomalies that suggest the email was not written by the claimed sender.
How to Check If an Email Is Phishing
Phishing emails remain the number one attack vector for cybercriminals, responsible for over 90% of data breaches. Checking whether an email is phishing requires examining both the visible content and the hidden technical headers that reveal where the email actually came from. Our free phishing email checker automates this process, but understanding what to look for helps you make better security decisions.
What Makes an Email Suspicious?
Phishing emails typically share common red flags that distinguish them from legitimate messages:
- Urgency or threats — "Your account will be suspended in 24 hours"
- Sender address doesn't match the claimed organization
- Links that display one URL but redirect to another domain
- Requests for credentials, payment details, or personal information
- Generic greetings instead of your actual name
- Unexpected attachments, especially .zip, .exe, or macro-enabled documents
- Grammar and spelling errors inconsistent with the supposed sender
- Lookalike domains using Unicode characters (homoglyph attacks)
Understanding Email Authentication: SPF, DKIM, and DMARC
Modern email security relies on three authentication protocols that work together to verify sender identity. When you paste email headers into this checker, these are the first things we validate:
SPF (Sender Policy Framework)
SPF verifies that the sending mail server is authorized to send on behalf of the domain in the envelope “From” address. A pass means the server is authorized; a fail or softfail suggests the email may be spoofed. Learn more about SPF →
DKIM (DomainKeys Identified Mail)
DKIM uses cryptographic signatures to verify the email body and key headers haven't been altered in transit. A valid DKIM signature proves the email is exactly as the sending domain created it. Learn more about DKIM →
DMARC (Domain-based Message Authentication, Reporting & Conformance)
DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails — reject, quarantine, or accept the message. A legitimate email should pass DMARC alignment. Learn more about DMARC →
Common Types of Phishing Emails
Understanding the types of phishing attacks helps you recognize them faster:
Credential Harvesting
Fake login pages designed to steal usernames and passwords.
Business Email Compromise
Impersonation of executives or vendors to redirect payments or data.
Spear Phishing
Targeted attacks using personal details to build trust.
QR Code Phishing (Quishing)
QR codes in emails that redirect to phishing sites, bypassing link scanners.
How to Extract Email Headers
To analyze an email with this checker, you need the full source including headers. Here's how to get them:
You can also upload .eml or .msg files directly using the upload button above.
How do I check if an email is phishing?
Copy the full email source including headers from your email client (in Gmail: three dots → Show original; in Outlook: File → Properties) and paste it into the analyzer above. The tool checks SPF, DKIM, and DMARC authentication, scans for suspicious links, detects spoofed domains, and provides a risk score from 0 to 100.
Is this phishing email checker free?
Yes, completely free with no signup or account required. There are no limits on the number of emails you can analyze. For automated analysis via API, you can create a free account on the DFIR Platform.
Does this tool store my email content?
No. All analysis runs entirely in your browser using client-side JavaScript. Your email headers and content are never uploaded to or stored on any server. This is a fully private, client-side tool.
What does the phishing checker analyze?
The checker runs 15+ analysis modules: SPF, DKIM, DMARC, and ARC authentication; homoglyph and typosquatting detection; link mismatch analysis; phishing template matching; IOC extraction (IPs, domains, URLs, hashes); HTML content analysis; OAuth consent URL detection; form action analysis; CSS cloaking detection; thread hijacking detection; RFC 5322 compliance; attachment risk assessment; QR code phishing detection; image-only email detection; and writing style anomaly analysis.
Can this detect business email compromise (BEC)?
Yes. The tool includes thread hijacking detection, writing style anomaly analysis, and sender domain spoofing checks designed to identify BEC attacks. It flags when reply chains appear compromised or when writing patterns are inconsistent with the claimed sender.
What are SPF, DKIM, and DMARC?
SPF verifies the sending server is authorized for the domain. DKIM uses cryptographic signatures to verify the email wasn’t tampered with. DMARC ties SPF and DKIM together with a policy for handling failures. A legitimate email should pass all three. Learn more in our wiki: SPF, DKIM, DMARC.
What should I do if an email is flagged as phishing?
Do not click any links or download attachments. Report the email to your IT security team or email provider as phishing. Delete the email. If you already clicked a link or entered credentials, change your passwords immediately, enable two-factor authentication, and monitor your accounts for unauthorized activity.
How accurate is this phishing detection tool?
The tool combines rule-based analysis with pattern matching across 15+ detection modules. It checks concrete, verifiable indicators like authentication failures, domain spoofing, and known phishing templates. No automated tool is 100% accurate — always use professional judgment alongside automated analysis, especially for sophisticated targeted attacks.
Exposure Scanner
Scan any domain for open ports, SSL issues, DNS misconfigurations, and attack surface exposure.
Domain Lookup
WHOIS, DNS records, reputation scoring, and certificate transparency for any domain.
File Analyzer
Upload suspicious files for hash analysis, multi-engine reputation checks, and threat classification.
Need Automated Phishing Analysis?
The DFIR Platform provides a full investigation workflow for security teams — phishing analysis via API, IOC enrichment, exposure scanning, and case management. Free tier available.