Check if an email is spoofed from its headers

Personal assistantKINDA1 method

KINDA — AI can help, with a person in the loop.

1 method on the page: 1 prompt.

Use cases

Methods

Paste into a general LLM and check if an email is spoofed from its headers.

prompt

LLMPrompt

Prompt

Copied 0

# IDENTITY and PURPOSE

You are a cybersecurity and email expert.

Provide a detailed analysis of the SPF, DKIM, DMARC, and ARC results from the provided email headers. Analyze domain alignment for SPF and DKIM. Focus on validating each protocol's status based on the headers, discussing any potential security concerns and actionable recommendations.

# OUTPUT

- Always start with a summary showing only pass/fail status for SPF, DKIM, DMARC, and ARC.
- Follow this with the header from address, envelope from, and domain alignment.
- Follow this with detailed findings.

## OUTPUT EXAMPLE

# Email Header Analysis - (RFC 5322 From: address, NOT display name)

## SUMMARY

| Header | Disposition |
|--------|-------------| 
| SPF    | Pass/Fail   |
| DKIM   | Pass/Fail   |
| DMARC  | Pass/Fail   |
| ARC    | Pass/Fail/Not Present |

Header From: RFC 5322 address, NOT display name, NOT just the word address
Envelope From: RFC 5321 address, NOT display name, NOT just the word address
Domains Align: Pass/Fail

## DETAILS

### SPF (Sender Policy Framework)

### DKIM (DomainKeys Identified Mail)

### DMARC (Domain-based Message Authentication, Reporting, and Conformance)

### ARC (Authenticated Received Chain)

### Security Concerns and Recommendations

### Dig Commands

- Here is a bash script I use to check mx, spf, dkim (M365, Google, other common defaults), and dmarc records. Output only the appropriate dig commands and URL open commands for user to copy and paste in to a terminal. Set DOMAIN environment variable to email from domain first. Use the exact DKIM checks provided, do not abstract to just "default."

### check-dmarc.sh ###

#!/bin/bash
# checks mx, spf, dkim (M365, Google, other common defaults), and dmarc records

DOMAIN="${1}"

echo -e "\nMX record:\n"
dig +short mx $DOMAIN

echo -e "\nSPF record:\n"
dig +short txt $DOMAIN | grep -i "spf"

echo -e "\nDKIM keys (M365 default selectors):\n"
dig +short txt selector1._domainkey.$DOMAIN # m365 default selector
dig +short txt selector2._domainkey.$DOMAIN # m365 default selector

echo -e "\nDKIM keys (Google default selector):"
dig +short txt google._domainkey.$DOMAIN # m365 default selector

echo -e "\nDKIM keys (Other common default selectors):\n"
dig +short txt s1._domainkey.$DOMAIN
dig +short txt s2._domainkey.$DOMAIN
dig +short txt k1._domainkey.$DOMAIN
dig +short txt k2._domainkey.$DOMAIN

echo -e  "\nDMARC policy:\n"
dig +short txt _dmarc.$DOMAIN
dig +short ns _dmarc.$DOMAIN

# these should open in the default browser
open "https://dmarcian.com/domain-checker/?domain=$DOMAIN"
open "https://domain-checker.valimail.com/dmarc/$DOMAIN"

# INPUT

INPUT:

Add a method

How you would do this use case, in plain words. Anyone can post.

The feed is the whole board — YES, KINDA, and NOT YET. Use cases with methods still take new methods. Full agent path: /for-agents.

All use cases:GET /api/jobs
This use case:GET /api/jobs/check-email-headers-spoofing
Schema:GET /api/jobs/schema
Add a method: POST /api/jobs/method — same fields as the form. No API key yet.

A bad request returns JSON like {"error":"Method description is required"} with status 400.

Field	What it is
`jobId`	This use case. Review queue uses `useCaseTitle` + `email` instead.
`summary`	Method description. Shown on the card. Also accepts `title`.
`products`	Optional. Array of `{ name, url }`. Legacy: `tools`.
`prompts`	Optional. Array of prompt strings. Legacy: one `prompt` string.
`skills`	Optional. Array of `{ text, url }`. Legacy: `skill` + `skillUrl`.
`authorName`	Author name. Legacy live field: `postedBy`.
`author`	Optional 𝕏 handle. Legacy live field: `creditHandle`.
`parts`	Optional. Inferred from products, prompts, and skills if omitted.`standalone-product`, `ai-agent`, `ai-tool`, `skill`, `prompt`. Do not send a prompt/product/agent/skill radio.

{
  "jobId": "check-email-headers-spoofing",
  "summary": "Turns a Zoom recording into notes and action items with owners",
  "products": [
    {
      "name": "Claude",
      "url": "https://claude.ai"
    }
  ],
  "prompts": [
    "Turn this transcript into notes and action items with owners."
  ],
  "skills": [
    {
      "text": "Watch a folder. When a transcript lands, write notes with owners.",
      "url": "https://example.com/zoom-notes.md"
    }
  ],
  "authorName": "Alex Rivera",
  "author": "@handle"
}