Start with the raw source
Use the mail client option that shows the original message or raw headers. Forwarded visible text often omits transport fields.
Paste headers only into tools you trust; they can contain addresses, message identifiers, hostnames, and routing details.
Read Received lines bottom-up
Each controlled server normally prepends a Received field. The earliest trustworthy hop is often near the bottom.
Fields inserted before a message reached a controlled server can be forged.
Check SPF, DKIM, and DMARC
SPF evaluates authorized sending infrastructure, DKIM verifies a cryptographic signature, and DMARC applies domain alignment and policy.
A pass supports authenticity of infrastructure or signed content, not necessarily the real-world identity of the person using an account.
Separate visible and transport identities
The display From field, envelope sender, return path, signing domain, and relay path may differ.
Forwarding, mailing lists, and legitimate services can create complex but valid combinations.
Redact before sharing
Remove personal addresses, message IDs, internal hostnames, and unnecessary routing data before posting a header publicly.
The MyIPCheckup analyzer runs locally in the page and does not upload pasted headers in this release.