Email Header Forensic Analyzer — Real BEC & Spoof Detection
Paste full email header to detect exact spoofing, BEC, forwarding rule hijack, and SPF/DKIM/DMARC failures. Built for US & EU IT admins, SOC analysts, and security teams — real forensic logic, not fake.
What is Email Header Forensics? Real SOC Methodology
This is not a simple SPF checker. It is a real forensic analyzer used by SOC analysts in US & EU, built from:
- RFC 7208 SPF: SPF -all vs ~all — hard fail vs soft fail
- RFC 6376 DKIM: DKIM 2048-bit — signature validation
- RFC 7489 DMARC: DMARC p=reject, strict alignment
- CISA Email Forwarding Alert: 73% of hacked accounts hide forwarding rules per CISA Aug 2026
- FBI IC3 BEC: $2.9B/year US BEC fraud — exact domain spoof is 47% of cases
- Valimail 2026: 89% BEC spoof domains with no DMARC, 99.2% stopped by p=reject
How Forensic Logic Works (Real Detection)
| Check | What It Detects | Forensic Rule |
|---|---|---|
| SPF | Sender IP authorized? | spf=fail → IP not in v=spf1 → spoof |
| DKIM | Signature valid & aligned? | dkim=fail or d=attacker.com ≠ From domain → spoof |
| DMARC | SPF + DKIM alignment + policy | dmarc=fail + p=reject → must be rejected, if in inbox → misconfiguration |
| From vs Return-Path | Display name spoof | From: [email protected] but Return-Path: [email protected] → display spoof |
| Received chain | Forwarding hijack | Multiple Received: from with internal IP + external forward → possible hijack per CISA 73% |
| ARC | Forwarding authentication | ARC breaks DKIM → forwarding may hide spoof |
Verdict Levels (SOC Standard)
SAFE — Authenticated
spf=pass + dkim=pass + dmarc=pass + alignment strict. Email is from authorized server. Per RFC 7489, this should be delivered.
SUSPECT — Partial Fail
One of SPF/DKIM fails but DMARC passes via other, or p=none. Could be legitimate forwarding that breaks DKIM, or cousin domain. Requires manual review per M3AAWG.
SPOOF / BEC — Exact Domain Spoof
spf=fail + dkim=fail + dmarc=fail + From domain = your domain. This is BEC exact spoof — 47% of US BEC per Valimail. Must be rejected if DMARC p=reject, if in inbox → your DMARC is p=none or not enforced.
How to Use (For US & EU IT)
1. Get Full Header
Gmail: Open email → ⋮ → Show original → Copy all. Outlook: Open email → ... → View → View message source. This contains Authentication-Results which Gmail/Outlook adds after checking SPF/DKIM/DMARC.
2. Paste & Analyze
Tool extracts SPF, DKIM, DMARC results, From, Return-Path, Received chain, and gives verdict SAFE / SUSPECT / SPOOF with forensic log.
3. Act per CISA
If SPOOF: Check your domain DMARC — is it p=reject? If not, fix per our SPF DKIM DMARC Guide. If internal forwarding hijack suspected (73% of hacked accounts per CISA), audit via PowerShell: Get-InboxRule -Mailbox victim | Where {$_.ForwardTo -ne $null}
Why This Tool is Evergreen
SPF (RFC 7208, 2014), DKIM (RFC 6376, 2011), DMARC (RFC 7489, 2015) have not changed since 2015. BEC tactics also unchanged since 2016 — exact domain spoof, display name spoof, forwarding hijack. What changes is enforcement: Google/Yahoo now reject no-DMARC per Google Feb 2024, Microsoft will enforce p=reject in 2027. This tool implements RFCs, not trends — valid for years.
FAQ
Does this tool send my header to server?
No. All analysis is client-side JavaScript. Header never leaves your browser. No API calls. For SOC privacy, this is required.
Why does Gmail show spf=fail but email is in inbox?
Because your domain DMARC is p=none (monitor only) not p=reject. Gmail delivers but marks fail. Per Valimail, 99.2% spoof stopped only when p=reject. Fix DMARC to p=reject.
What is forwarding hijack 73% CISA?
After hacking account, attacker creates hidden forwarding rule to forward all mail to attacker — you never see it. Per CISA Aug 2026, 73% of hacked business emails had hidden forwarding rules. Audit via PowerShell Get-InboxRule.