email header route
An email header carries more than sender and subject: every server the message crosses adds a Received line to the top of the header block, so the whole list has to be read bottom to top to rebuild the real path, from the origin server to your inbox. That set of fields, together with Return-Path and Authentication-Results, is where most of the signs of a forged message actually live.
The address inside the display name's quotes is never validated, it is just text; the address that matters is the one between the angle brackets, and here it points to a different domain.
The smtp.mailfrom in the SPF result shows the envelope's real domain (evil.tld), different from the header.from that DMARC compares (bank.com); both failing at once is the receiving server's own verdict, not a guess by the tool.
This is routine in email marketing, which often uses a third-party service purely for technical delivery; the difference only becomes real suspicion when combined with other signals, like a missing Authentication-Results or a generic hostname in Received.
In Gmail, open the message, click the three dots (⋮) and choose “Show original”. In Outlook, open the message, go to File › Properties and copy the “Internet headers”. In Apple Mail, use View › Message › All Headers. Paste the whole block here.
They are not in the wrong order, each new server inserts its line at the top of the header block as it processes the message; that is why the most recent Received comes first in the list, and you have to read bottom to top to reconstruct the route from sender to you.
From is the sender shown in the inbox; Return-Path is the technical envelope address that bounced messages return to, and it is Return-Path, not From, that SPF actually checks against the sending server's IP.
It is the verdict the receiving server itself wrote after checking SPF, DKIM and DMARC; since the receiver writes this line, not the sender, it is far more trustworthy than any field the message's author controls.
Compare the real address, between the angle brackets in the From field, with any email address written inside the display name itself; if they are different domains, the message is using a plausible name to hide the true sender.
Paste the original header (Gmail: ⋮ › “Show original”; Outlook: File › Properties › Internet headers). Folded lines and the blank line before the body are handled automatically.
The tool reconstructs the path the message traveled (Received chain), computes the delay at each hop, extracts the key fields and shows the SPF, DKIM and DMARC results. Nothing leaves your browser.
For safety and privacy, this tool sends nothing anywhere: you paste the header and all analysis, parsing, route and authentication, runs 100% in your browser. No server is used as an intermediary.