Skip to main content
DFIRLab
ResearchIntel BriefingsPhishing CheckDomain LookupExposure ScannerPrivacy CheckAbout
PlatformNew
DFIRLab
Privacy Policy/RSS Feed/Sitemap

Security research, threat intelligence, and detection engineering.

© 2026 DFIR Lab. All rights reserved.

Free Tool

Phishing Email Checker

Analyze suspicious email headers for spoofing, authentication failures, and threat indicators. Paste your headers below for instant analysis.

Your email data never leaves your browser

Paste headers below or upload an email file

Copy the full email headers from your email client and paste them above. All analysis runs entirely in your browser. Email files (.eml, .msg) are processed locally and never uploaded to any server.

70+ Checks We Run

Authentication & Trust

SPF / DKIM / DMARC
DKIM Signature Verification
ARC Chain Validation

Header Forensics

Email Route Tracing
Spoofing Detection
Message-ID Mismatch
Fake Re:/Fwd: Detection
Received Header Injection
MIME Boundary Fingerprinting
MTA Software Fingerprinting
RFC 5322 Compliance

Content Analysis

Social Engineering Detection
Hidden Text (CSS Tricks)
HTML Form & Credential Harvest
Script / Iframe Detection
Tracking Pixel Detection
CSS Content Cloaking
Link-Text Mismatches
OAuth Consent URL Detection

Attachment & Media

Dangerous File Types
QR Code Decoding
SVG Content Analysis
ICS Calendar Invite Analysis
Password + Archive Pattern
Image-Only Email Detection

Threat Intelligence

IOC Extraction
Domain Impersonation
Blacklist / RBL Check *
Toolkit Fingerprinting

AI-Powered Analysis

Phishing Template Matching
Writing Style Analysis
Persuasion Principle Scoring *
Manipulation Dimension Scoring *
Freemail + Brand Correlation

* Limited on free tool — full analysis available via API. All heuristic checks run locally in your browser.

How It Works
Step 01

Paste Headers

Copy the full email headers from your email client (Gmail, Outlook, Thunderbird, etc.) and paste them into the text area above.

Step 02

Instant Analysis

The checker parses authentication records (SPF, DKIM, DMARC), traces the email route, extracts IOCs, and detects spoofing patterns.

Step 03

Get Verdict

Receive a risk score (0-100) with a clear verdict, key findings, and recommended actions based on the analysis.