Email Spam and Phishing Checker

Open the email in your mail app, copy its full source (headers and body) and paste it in the box below.

0 KB

The message is checked in memory and is not stored. Links in it are never opened.

Checking authentication, the sending server and the content…

Email Spam and Phishing Check Overview

What does this email spam checker do?

It reads the full source of one email, the same text your mail app keeps behind the message, and checks who really sent it. Spam filters and phishing emails both leave traces in the headers: which server sent the message, whether the sender's domain allowed that server, and whether the message was signed. The checker reads those traces, looks for common sender tricks, and gives one plain verdict with the reasons behind it.

What does it check?

  • Sender authentication: SPF, DKIM, DMARC and ARC. It reads the result your mail provider stamped on the message at delivery and also runs its own check.
  • The sending server: its IP address, reverse DNS, network owner and location.
  • Sender tricks: a company name sent from a free email account or from a domain that does not belong to that company, look-alike domains, a different Reply-To address, and more than one sender.
  • Links: the shown text against the real destination, bare IP addresses, short links and look-alike characters. Links are examined by name only and never opened.
  • Attachments: file types often used to spread viruses and files that pretend to be documents.
  • How recently the sender's and the links' domains were registered.

How do I read the verdict?

  • Genuine: the sender is verified and no serious warning signs were found.
  • Probable spam: some warning signs were found. Confirm the sender another way before you click anything.
  • Spam: strong warning signs, such as a failed DMARC check on a protected domain or a company name used without the company's authentication. Do not click links or reply.

Below the verdict, the detailed view lists every finding with what to do about it, plus the authentication results, the sending server, the delivery path, links, attachments and domain ages.

Is my email stored?

No. The message is checked in memory on our server and dropped as soon as the result is sent back. Our logs keep only the size, the verdict, the score and how long the check took, never the content or any email address.

FAQs

No. The message is checked in memory and dropped as soon as the result is sent back. Our logs keep only its size, the verdict, the score and how long the check took, never the content or any email address. Links in it are never opened.

The headers at the top of the source show which server really sent the email, the SPF, DKIM and DMARC results your mail provider recorded at delivery, and the path the message took. The visible text alone cannot show any of that.

Yes. These checks prove that the sending domain allowed the message, not that the sender is honest. A scammer can authenticate a domain they own, so the checker also looks at look-alike domains, brand names, links, attachments and how new the domains are.

Some warning signs were found, but not enough to be sure. Do not click links or open attachments until you have confirmed the sender another way, for example through the company's official website or app.

The signing key may have been rotated since the email was sent, or copying the source changed a few characters of the body. The checker treats this as unverifiable, not as a failure, and relies on the result your mail provider recorded at delivery.

Yes. It is free and you do not need an account. Paste one message at a time, up to 2 MB.