Free Tool · Email Security

Is This Email Genuine?

Written by James Batt CISSP · CEH · Last reviewed 10 September 2026

Paste the hidden delivery record from a suspicious email and get a plain-English answer in seconds — whether the sender really is who they claim to be, and what to do next.

Every email carries a technical record of how it actually reached you. It is the closest thing email has to a paper trail, and it is difficult to fake convincingly. This checker reads that record the way a security analyst would, then tells you what it found in ordinary language rather than jargon.

It is free, there is nothing to sign up for, and it works on any email from any provider.

The checker is just below

At a glance

Private — nothing you paste leaves your computer

Instant — a full answer in seconds, at no cost

Checks sender authentication and the full delivery chain

Written for business owners, not IT departments

Check the email now

Paste the delivery record from the email and this checker reads it the way a security analyst would, then tells you in plain English whether the sender really is who they claim to be — and which of the usual tricks are present.

What happens to what you paste. Nothing. This tool makes no network request at all. The headers are read by your own browser, on your own computer — they are not sent to us, not stored, and not logged. Once this page has loaded you could disconnect from the internet and it would still work.

Read this before you trust a pass. No checker on earth — not this one, not your spam filter, not your mail provider — can catch an email sent from a real account that a criminal has got into. If they are sitting in your supplier’s mailbox, or your accountant’s, or a colleague’s, the message they send really is from that account. It passes SPF, DKIM and DMARC. It sails through the spam filters. It arrives in the right thread, in the right tone, often replying to a genuine email you sent. This tool will tell you it looks fine, because as far as the email system is concerned it is fine.

That is how most invoice fraud actually happens, and it is why a pass here is never permission to pay. Before you pay an invoice, change any bank details, or send anything confidential, ring the person on a number you already had — not one from the email.

The email’s headers

Not the message itself — the hidden delivery record behind it. It usually starts Delivered-To:, Received: or Authentication-Results:. Copy the whole thing; half of it is worse than none.

Where do I find these?

Outlook (Windows desktop). Double-click the email so it opens in its own window, then File → Properties. The headers are in the Internet headers box at the bottom. Click inside it, press Ctrl+A then Ctrl+C. Step by step, with screenshots.

New Outlook and Outlook on the web. Open the email, click the three dots at the top right of the message, then View → View message details. Step by step, with screenshots.

Outlook on a Mac. There is a guide for that.

Gmail. Open the email, click the three dots beside the reply arrow, then Show original. A new tab opens — use the Copy to clipboard button on it.

Apple Mail. View → Message → All Headers, or Raw Source. Select it all and copy.

On a phone. Most phone mail apps will not show you the headers at all. Wait until you are at a computer — and do not tap anything in the email in the meantime.

Try an example

Not sure what it is telling you?

If this is an invoice, a payment request or a change of bank details, do not act on it until somebody has looked properly. Send me what the checker said and I will tell you what I see.

Talk to James

What this can and cannot tell you. It reads the verdicts your own mail provider stamped on the message when it arrived, and the addresses hidden behind the one you were shown. It is not re-running those checks and it cannot — if the headers were forwarded, shortened or edited, it is reading whatever it was given. A pass proves where a message came from, never that it is true. A fail is a strong signal, not a certainty: a badly configured forwarder or mailing list can fail these checks with nothing sinister behind it.

No responsibility accepted. This checker is provided free of charge, as is, for general information only. It is not advice on your particular situation, it is not a security audit, and it is not a substitute for judgement. No guarantee is given that what it reports is accurate, complete or current. Systems Secure Ltd accepts no responsibility or liability for any loss, damage, cost or expense arising from its use — including anything it reports, anything it misses, and any decision taken on the strength of it. What you do about an email remains your decision and your responsibility. Use of this tool is subject to our terms and conditions.

If you think you have already paid a fraudulent invoice or handed over a password, ring your bank first, then report it to Action Fraud on 0300 123 2040. Speed matters more than anything else at that point.

Who wrote this

James Batt

CISSP CEH Founder, Systems Secure

Twenty-five years as an IT architect in the oil and gas industry, designing multi-million pound systems for companies around the world, before going independent. These days the work is smaller and a good deal more useful: helping UK businesses get enterprise-grade security without an enterprise budget.

I built this checker because the answer is usually sitting right there in the email, and you shouldn’t need to know somebody like me to read it. Check it yourself, at any hour, without sending your message to anyone.

If you want me to look into it more deeply, pick up the phone — or get in touch whichever way suits you.

Book a consultation Free · 30 minutes Call or text 07702 896 910 WhatsApp 07702 896 910 Email [email protected] Microsoft Teams [email protected]

No obligation · No sales script · You keep the findings either way

Questions you're probably asking

Is it safe to paste my email headers here?

Yes. Nothing you paste leaves your computer. The checker is a small piece of code that runs inside your own web browser, on your own machine — there is no upload, no server receiving anything, and nothing stored or logged at our end. If you want to prove it to yourself, disconnect from the internet once the page has loaded and the checker will still work perfectly. Headers do contain your email address and details of the servers involved, which is precisely why we built it this way.

Can email headers be faked?

Parts of them, yes — and that is exactly what the checks are for. Anyone can type whatever they like in the From line. It is no more reliable than the return address written on the back of an envelope. What is far harder to fake is the record each mail server adds as the message passes through, and the pass-or-fail verdicts your own mail provider stamps on it the moment it arrives. Those get added after the sender has lost control of the message. A forger can write a convincing From line, but they cannot make somebody else's server vouch for them.

It says the email passed — does that mean it's safe?

No, and this is the most important thing on the page. A pass means the message genuinely came from the domain printed on it. It tells you nothing about who was sitting at the keyboard. If a supplier's or a colleague's real account has been broken into, every email the criminal sends from it will pass every check here — because it really is their account. That is how most invoice and payment fraud against small businesses actually works. Treat a pass as one piece of evidence, not as permission. Anything involving bank details, a payment or a password still gets confirmed by phone, on a number you already had.

What does it mean when the result says "not recorded"?

It means those checks were not in the text you pasted, almost always because only part of the record was copied. The verdicts are added by your own mail provider and sit near the top of the record, so if you started copying partway down, they are missing. Go back and copy the whole block, starting from the very first line. You will also see it on internal email that never left your own systems, which is normal and not a cause for concern.

Does this work with Gmail, Outlook, anything else?

Yes. The delivery record is part of how email itself works, so every provider produces one and the checker reads them all the same way. The only thing that differs is where you click to find it, and the panel further up this page covers Outlook, Gmail and Apple Mail. One thing matters more than which provider you use: check the original email, not a forwarded copy. Forwarding rewrites the record, so you would be checking your own message rather than theirs.

I think someone is targeting my business — what should I do now?

Stop and confirm before you do anything else. If the email asked you to pay something, change bank details or log in somewhere, do not do it — and do not use any phone number or link taken from the email itself. Ring the organisation on a number you already had. If someone has already clicked, entered a password or made a payment, change that password immediately from a different device and tell your bank straight away. Then send it to me and I will look at it myself, at no charge. A live attempt on a business is rarely aimed at one person, so the rest of your team need to know today.

Should I report the email to anyone?

Yes, and it takes seconds. Forward suspicious emails to [email protected], the National Cyber Security Centre's reporting service. Scam text messages go to 7726, free from any UK mobile. If money has already gone or an account has been broken into, report it to Action Fraud on 0300 123 2040 or at reportfraud.police.uk, which covers England, Wales and Northern Ireland — in Scotland, report to Police Scotland on 101. It is worth doing: reporting is how fake websites get taken down before they catch somebody else.