Paste a message's raw headers to trace its hop chain, read its authentication results and compare its sender addresses.
Paste the full raw headers of a message, the block mail programs show under headings such as view original, show original or message headers, and the analyser works through them locally. Received headers are added at the top by each server that handles a message, so reading them in delivery order means starting from the last Received header in the pasted block and working up. The analyser rebuilds that hop chain with the from, by, with and time details where each hop provides them, pulls the spf, dkim and dmarc verdicts out of any Authentication-Results headers, and compares the domains in From, Return-Path and Reply-To, which legitimately differ for bulk and forwarded mail but are worth noticing when they do not match the sender a message claims to be.
How do I get a message's raw headers? Most mail programs have an option labelled show original, view message source, or message headers in the menu for an opened message. Copy the whole header block, from the first Received line down to the blank line before the message body.
Why is the hop chain shown in reverse order to the paste? Each server prepends its Received header, so the newest hop is at the top of the pasted block and the originating hop is at the bottom. Delivery order is therefore the reverse of the order in the raw headers.
Does a From and Return-Path mismatch mean a message is fake? Not on its own. Newsletters, mailing lists and sending services routinely use a different Return-Path domain for bounce handling. A mismatch is a prompt to check the authentication results and the actual links and requests in the message, not proof by itself.