Is my email header uploaded?

No. Analysis happens locally in your browser. The raw header never leaves your device.

It parses From, Reply-To, Return-Path, Received hops and Authentication-Results (SPF/DKIM/DMARC), and flags mismatches such as a Reply-To that differs from the From address.

Does it replace my email provider?

No. It is a quick triage aid for suspicious messages — always verify with your mail provider or security team.

Email Header Analyzer — Local Parsing

What this checks

From, Reply-To, Return-Path and the Received chain (hop count).
Authentication-Results: SPF / DKIM / DMARC outcomes.
Common spoofing signals — e.g. Reply-To differing from From, failed SPF/DKIM/DMARC.

Only the fields needed for the analysis are kept in memory; nothing is transmitted.

Related Knowledge

How to Analyze Email Headers — read SPF, DKIM and DMARC results.
Phishing Email Investigation Playbook — from header to verdict.
Phishing Defense Checklist — full triage from header to containment.
How to Analyze DNS Records — verify the claimed domain's SPF/DMARC configuration.