nicksec
Read an email's headers the way an investigator does.
Paste the full header block from a suspicious message. You'll get the authentication verdicts, who the mail really came from, and every server it passed through.
Headers are analyzed in memory and discarded. Nothing you paste is stored or logged.
Where do I find the headers?
Outlook: open the message, then File, Properties, and copy "Internet headers".
Gmail: open the message, the three-dot menu, then "Show original", and copy everything above the message body.
Subject
What stands out
Who sent it
The route it took
Oldest hop first. Hops near the top were added by servers you don't control, so treat them with suspicion.