Check if an Email Is Legit by Analyzing Its Headers

1. Copy the headers

• Outlook desktop: open the message > File > Properties > Internet headers.
• Outlook on the web: ... > View > View message details.
• Gmail: ... > Show original.

2. Paste them into Google Admin Toolbox Messageheader (or Microsoft's Message Header Analyzer).

3. What to check:

• From vs Return-Path / Reply-To: the domains should match the real sender. A different Reply-To is a classic phishing sign.
• SPF, DKIM and DMARC: they should show pass for the sender's domain.
• Received hops: the servers the mail went through (read from bottom to top). Unexpected countries or random servers are a red flag.
• Delivery delay: normal mail arrives in seconds. Big delays point to relays or queues worth a closer look.