Where did this email really come from?
Every email carries hidden headers: which servers handled it, and whether the sender's domain vouches for it. Paste them here to see who sent it, the route it took and what the checks say, in plain words.
Open the email, click the ⋮ menu next to Reply and choose Show original. Copy everything on that page.
The headers are read in your browser and never sent anywhere. Only the mail servers' public addresses are looked up on ip5.io.
No email headers found. Copy the full headers (in Gmail: Show original), not just the message text.
Lines at the top of every email that mail apps hide: who sent it, when, which servers passed it on, and the results of the sender checks. They're part of the email itself, so every copy has them.
Three checks your mail provider runs on every email. SPF: is this server allowed to send for the domain? DKIM: is the domain's digital signature intact? DMARC: does the domain in the From line match what passed? When all three pass, the email really came from that domain.
Rarely. Big mail services like Gmail and Outlook leave the sender's own address out of the headers. You see their servers, which say nothing about the person. Small mail servers and some business systems still include it.
Every server that passes the email on adds its line at the top. So the oldest step is at the bottom of the headers. This page puts them back in order, from the sender to you.
They're read in your browser and never sent to ip5.io; only the mail servers' public addresses are looked up. Headers do contain your own email address, so remove it first if you share them anywhere else.