Paste the From line (and optional body) — we estimate sender-spoofing/phishing risk from the display name, domain and body, no model, no lookup.
Free with no sign-up, and the check runs inside your browser, so what you enter never leaves your device. The result is a signal to help you decide, not proof for money or legal decisions.
Paste the sender address, display name and body of a received email, and it estimates the likelihood of sender spoofing overall. It computes this rule-based, without any AI model.
The most common is "display-name spoofing". The screen shows "Naver Support" but the real address is something unrelated like no-reply@naver-help.xyz. Mail apps usually show only the big display name, so you must expand the actual address.
Look-alike domains (naver.com → navercorp-mail.com), recently created unfamiliar domains, and a Reply-To that differs from the sender address are all spoofing signals. An urgent demand in the body ("account suspension pending, verify now") layered on top raises the risk.
These three verify "did this domain really send this mail". SPF checks the sending server is authorised, DKIM checks the body was not forged via a signature, and DMARC sets the policy when either fails. Formal header verification happens on the mail server; this tool instead checks the sender and body signals a person can see.
So this result is not a replacement for header authentication. It is an aid that quickly catches the things people commonly miss, such as a mismatch between the display name and the domain.
Mail apps show you a tidied-up view, but what you need for a judgement is in the raw headers. Gmail has "Show original" in the menu at the top right of a message, Outlook has "View message source", and most other clients have an equivalent.
Near the top, an Authentication-Results line records pass or fail for spf, dkim and dmarc. A fail on any of them means the identity the sending domain claims does not match how the mail actually travelled, and should be read as a strong warning.
A pass, however, is not safety. An attacker who configures their own domain properly gets a clean pass for that domain. Authentication says "this domain really sent it" and nothing at all about whether the domain deserves trust. Results have to be read next to the domain name itself — which is the part this tool looks at.
Attachments hide behind their extensions. A file named quote.pdf.exe displays as quote.pdf under default Windows settings. Documents demanding that macros be enabled, archives that unpack into executables, and HTML attachments that open a login screen are all aiming at the same outcome.
Link text and link destination are separate things. The body may show an official address while the actual href points somewhere else entirely. On a computer, hover and read the status bar; on mobile, long-press to see the address. Copy that address into the link check on this site for a second pass.
The type that costs organisations most has neither attachment nor link: a message impersonating a supplier or an executive, saying only that the bank details have changed and to send payment to a new account. There is almost nothing technical to detect. The only reliable defence is a rule that account changes are confirmed through a different channel — a call to a number you already hold.
It arrived as a reply in an existing thread, quoting earlier messages, with the usual contact name and signature. No attachment, no link — one line asking that this invoice go to a new account. With almost no technical signal, the score comes out low. About all the check can catch is a reply-to address that differs slightly from the original domain. Bank detail changes are the one thing that cannot be settled by email: call a number you already have.
The display name read like a tax authority while the actual sender address was on a lookalike domain, and the body links pointed at that same domain. Spoofing signals come back high. The attack relies on mail clients showing only the display name, so expanding the full address defeats most of this family on its own.
Sender domain and link domain matched, and the body contained an order number and recipient details that only the real sender would know. The score stays low. Personalised factual detail is the hardest thing for bulk fraud to fake, and combined with domain alignment it weighs strongly toward trust.
Legitimate companies send through third-party providers, so the sender domain differs from the company domain. This tool counts that mismatch as a spoofing signal and the score rises. The opposite limit matters too: SPF and DKIM headers are not present in pasted text, so authentication cannot be verified here. For any email asking for money or credentials, confirm with the sender through a separate channel regardless of the score.
No. What you paste is analysed only in your browser and is never sent to a server.
Formal authentication is judged by the server from the raw message headers. This tool is an aid that checks the sender and body signals a person can see.
Usually not. Sender addresses are easy to forge, and spam that appears to come from the recipient is common. If the message is not in your sent folder and your login history shows nothing unfamiliar, forgery is the likelier explanation.
An unexplained attachment is itself the signal. Genuine business mail says what it is sending and why, even in one line. Even from someone you know, an empty body can mean a compromised account. Verify through another channel before opening it.