Email Checker
Paste a suspicious email and see whether it carries the signs of phishing: a forged or lookalike sender, links that lead somewhere else, dangerous attachments.
The email is analysed on our servers in Switzerland, in memory only: it is never stored, logged or shared. The address of the server that delivered it and the fingerprints (SHA-256) of its attachments are checked against our databases.
Beyond this page
How EXYS stops emails like this across your organisation
Here you check one email, when it looks odd to you. In a company protected by EXYS the same threat intelligence works on its own, at every step a phishing attack needs to succeed, with our analysts behind every alert.
EXYS5100 SECURE DNS
Secure DNS refuses to resolve phishing and malicious domains: the link opens nothing. Every blocked request is logged, so it can be traced back to the device that made it.
Learn more about EXYS5100 SECURE DNS
EXYS AURA
AURA watches the Microsoft 365 audit logs around the clock: a sign-in from an unusual country, impossible travel, a new forwarding rule set by the attacker. Every event is enriched with IP reputation, and our analysts follow up.
Learn more about EXYS AURA
EXYS7950 KONDRA
Kondra monitors your network, events and endpoints in real time: its anomaly detection rules flag what a file does once it runs, and the events that led to the incident can be traced step by step.
Learn more about EXYS7950 KONDRA
How to get the original email
What counts is in the headers, which a normal copy and paste leaves out. Each mail client has a way to show them:
- Gmail Copy and paste
- Open the email, ⋮ menu → Show original → Copy to clipboard, then paste it above.
- Outlook on the web Copy and paste
- Open the email, ⋯ menu → View → View message source, then copy everything.
- Outlook for Windows/Mac .eml file
- Drag the email onto the desktop to save it as a file, or File → Save As. In the new Outlook: ⋯ → Save as (.eml). A .msg file cannot be read here: save it as .eml.
- Apple Mail Copy and paste .eml file
- View → Message → Raw Source, or File → Save As (Raw Message Source).
- Thunderbird Copy and paste .eml file
- View → Message Source (Ctrl+U), or File → Save As → File (.eml).
Checking one sent to a colleague? Ask them to forward it as an attachment: a normal forward replaces the original headers with theirs.
How to read it
Only the top headers count
Every server an email passes through adds lines on top. The ones at the top come from your provider; everything below was written by the sender, who can invent anything. We read only the top ones.
A pass is not a clean bill of health
DMARC pass means the email really comes from its domain. A scammer who registers paypa1-secure.com passes too: that is why we also look at what the domain is.
Rules, not guesses
Every finding is a check we can explain. No red flags means none of them fired, not that the email is safe.