Understand what to do
Start with the risk rating, why it matters and what to verify before you click, reply or pay.
EMAIL HEADER ANALYSERTurn raw email headers into useful security evidence.
Headers can reveal how a message was authenticated, which identities it used and where it appears to have travelled. Jatzo brings that evidence into one assessment.
- From
- Sam Patel <sam.patel@yourfirm.example>
- Subject
- Notes from Tuesday's planning meeting
Email risk score
1/100
Risk gradeLow risk
The available checks did not find significant phishing indicators. This does not guarantee the email is safe.
What was checked
- SPF: pass for yourfirm.example (the envelope sender)
- DKIM: pass for yourfirm.example (the signing domain)
- DMARC: pass for yourfirm.example (the From domain)
- Links: none in the message
- Attachments: none
- Requests: nothing asking you to sign in, pay or open a file
Recommended action
Treat unexpected links, attachments and requests cautiously and verify the sender independently before acting.
Check. Understand. Act.
- 01
Check
Paste it, or check in Outlook.
- 02
Understand
A grade, reasons and evidence.
- 03
Act
Your next step, in plain English.
What the headers can prove, and what they cannot.
Identity comparison
Review From, Reply-To, Return-Path and Sender relationships.
SPF, DKIM and DMARC
Report authentication evidence present in the supplied headers.
Source IP context
Eligible plans can inspect public source IP evidence and supporting network context.
One assessment
Combine header evidence with links, content and attachments instead of reading headers in isolation.
What was checked, line by line.
Checked
SPF: pass for yourfirm.example (the envelope sender)
Checked
DKIM: pass for yourfirm.example (the signing domain)
Checked
DMARC: pass for yourfirm.example (the From domain)
Checked
Links: none in the message
Checked
Attachments: none
Checked
Requests: nothing asking you to sign in, pay or open a file
What a result cannot tell you.
- A low score is not a guarantee.
- Missing evidence is not proof of safety.
- Automated analysis can be wrong.
- Verify requests through a route you trust.
What the headers actually mean
SPF asks whether the server that sent the message was one the sending domain says may send for it. DKIM asks whether the message carries a signature that matches the domain's published key, and whether it still matches after the journey. DMARC ties the two to the address you actually see in the From line, which is the part that matters, because SPF and DKIM can both pass for a domain nobody reads.
The Received lines are the message's route, written by each server that handled it, newest at the top. They are useful from the top down: the hop your own provider wrote is the one it cannot lie about, and everything below it was written by whoever sent the message.
Headers on their own answer less than people expect. A message can authenticate perfectly and still be an attack, because the account it came from was taken over. Jatzo reads them beside the links, the language and the attachments rather than in isolation.
How to read email headersStart with five free checks each month.
See the analysis before deciding whether you need a paid plan.
Clear guidance for you. Detailed evidence for your experts.
You should not need an IT background to check a worrying email. Jatzo explains the warning signs and your next step in everyday language, whether you are at home, running a business or working in a team.
Investigate when you need to
Explore the available header, link and attachment evidence, with source-network details and live reputation on the relevant plans. Expert detail stays alongside the explanation.
A decision aid for people and their IT teams. Jatzo cannot guarantee that a message is safe.