Private browser tool

Check a suspicious email.

Paste the raw message or open an .eml file. The checker runs in this browser and does not upload the message.

Include Authentication-Results, Received, From, Reply-To and Return-Path when available.

Analysis

A useful first pass, with clear limits.

The result will appear here. No message data leaves this browser.

What this checker can reveal

It surfaces visible sender identities, reply-address differences, authentication results and domains found in links. It never opens those destinations. A passing result cannot prove safety because compromised accounts and well-configured criminal domains may authenticate successfully.

How to obtain the original source

In Apple Mail on Mac, use View, Message, All Headers or save the message as Raw Message Source. In Gmail, choose Show original from the message menu. In Outlook, open View message details or Internet headers. On iPhone, use the connected Report to Meilo folder when you need the server to preserve the full original.

How to read the result

Start with the visible From address, then compare Reply-To and Return-Path. SPF identifies an authorized sending server, DKIM validates a signature, and DMARC checks whether an authenticated domain aligns with the address people see. A mismatch or failure deserves attention, while a pass only confirms how the message was sent.

Do not click a suspicious link or attachment to collect more evidence. The message source is enough for an initial review.