Someone reported an email. Is it phishing?
Paste the message's full source - headers and all. Your browser reads what the receiving server recorded about SPF, DKIM and DMARC and works out whether they vouch for the From address, lays out the relay path, unwraps Safe Links, flags look-alike domains, disguised links, dangerous attachments and payment-fraud language, hashes the attachments and lists what to block. Free, before you sign in, and nothing is fetched. Then the desk triages it: a verdict, the evidence, what each person should do, and a reply for whoever reported it - checked against the headers before you trust it.
The people, companies and domains in the examples are invented. Each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
What this does, and what it does not
The check is computed, not guessed. The page reads the verdicts the receiving server wrote
into Authentication-Results (it cannot re-verify a DKIM signature or look up
an SPF record, because it makes no network calls) and works out DMARC alignment from the
domains: SPF or DKIM only vouch for the From address when their domain belongs to the same
organisation. Organisations are approximated with a short public-suffix list. Look-alike
detection folds digits, rn/m and Cyrillic or Greek letters and
measures edit distance against your domains and a short list of brands people are
commonly phished in the name of. Links are never opened; attachments are never opened,
only named, typed and hashed.
The triage cannot see anything the page did not: no domain age, no reputation, no sandbox. It is told so, and every indicator it lists is matched against your paste before it can be exported. A pasted message stays in this browser unless you run a triage, which sends the page's facts and a trimmed excerpt of the body. Derived from the agent skill @zhaoxuya520/email-security (MIT), defensive half only. Sources are listed in llms.txt.