Email Header Analyzer
Paste the full raw headers from an email (in Gmail: "Show original"; in Outlook: "View message source") to see the delivery path and authentication results.
What to look for
A phishing red flag: the "From" address domain doesn't match the domain in the earliest (originating) hop, or SPF/DKIM/DMARC all show "fail" or "none" for a message claiming to be from a well-known company. Large, unexplained time gaps between hops can also indicate a message was held or relayed through an unexpected system.