MailDingo

Free email header analyser

Fetch the truth from an email

Paste a message's full headers. MailDingo shows where it came from, which server vouched for it, how long each hop took, and whether the sender is who they claim to be, in plain English.

Runs on your device. Headers contain personal data, so nothing you paste is uploaded, stored or logged. How we know

MailDingo, a ginger dingo trotting along with a letter in its mouth

Paste the headers

Where do I find them?
Try an example: Genuine colleague, Google WorkspaceNewsletter via Amazon SESShop receipt via SendGridMailing list + ARCMicrosoft 365 to Microsoft 365Spoofed bank alertCEO fraud (display name)Delayed 3 h 51 minLook-alike (homograph) domainSmall business, SPF softfailForwarded with SRS

What MailDingo checks

Authentication

Reads the SPF, DKIM, DMARC and ARC results your provider recorded and explains each one, including whether the passing domain actually aligns with the From address.

Route and delays

Turns the Received lines into a timeline, converts every timestamp to UTC and shows the delay at each hop, so a slow server stands out.

Red flags

Reply-To traps, display-name spoofing, mismatched Return-Path, look-alike domains with Cyrillic or Greek letters, and missing authentication.

The raw view

Every field in a monospace view, colour-coded and linked to its explanation, with encoded subjects and names decoded. Recognises Gmail, Microsoft 365, Amazon SES, SendGrid and more.

MailDingo can't look anything up on the internet: it shows what the receiving server recorded when the message arrived, which is the evidence that matters. How it works

Worked examples

All 11 examples

Invented but realistic messages: genuine mail, spoofs, a mailing list rescued by ARC, a look-alike domain and a four-hour delay. Open one to see the full analysis.

Looks genuine Genuine colleague, Google Workspace A normal, fully authenticated message between two companies that both use Google. The baseline every other example is compared with. SPF passDKIM passDMARC pass Looks genuine Newsletter via Amazon SES Bulk mail sent by a mail service on a company's behalf. SPF passes for the service's own domain, and DKIM is what ties it to the company. SPF passDKIM passDMARC pass Looks genuine Shop receipt via SendGrid A transactional email from a shop that set its sending service up properly: both SPF and DKIM align with the From domain. SPF passDKIM passDMARC pass Check carefully Mailing list + ARC Mailing lists add subject tags and footers, which breaks the author's DKIM signature. ARC lets the list pass on what it saw before it changed anything. SPF passDKIM failDMARC failARC pass Looks genuine Microsoft 365 to Microsoft 365 What Exchange Online headers look like: many internal hops with IPv6 addresses, 'Microsoft SMTP Server' as the protocol, and Microsoft's own compauth verdict. SPF passDKIM passDMARC pass Suspicious Spoofed bank alert A forged From address that fails every check. It only reached the inbox because the bank's DMARC policy is still p=none. SPF failDMARC fail

Guides

All 28 guides

Find the headers

Read the fields

SPF, DKIM, DMARC and ARC

Spot a fake

Delivery and delays

What does that result mean?

All results

SPF

SPF checks whether the server that delivered the message was allowed to send for the envelope (bounce) domain.

spf=pass spf=fail spf=softfail spf=neutral spf=none spf=temperror spf=permerror

DKIM

DKIM checks a cryptographic signature that a domain (d=) put on the message, proving that domain handled it and the signed parts were not changed.

dkim=pass dkim=fail dkim=neutral dkim=none dkim=temperror dkim=permerror dkim=policy

DMARC

DMARC asks: did SPF or DKIM pass for a domain that matches the From address you see? That match is called alignment.

dmarc=pass dmarc=fail dmarc=none dmarc=temperror dmarc=permerror

ARC

ARC records what earlier servers (forwarders, mailing lists) saw, sealed with their signatures, so the final receiver can trust results that forwarding broke.

arc=pass arc=fail arc=none