ToolsEmail

Microsoft phish and spam report analyser

Open a message a user reported, or one that got through, and see what Microsoft 365 concluded, why it did or didn't stop it, what looks wrong, every domain involved, and what to do next.

The message is analysed in your browser and never uploaded
Optional: domain registration dates, through abbott.cloud, only if you ask

The message

Paste the message headers (or the whole message)

Use the reported message's .eml file, a user's report with the original attached, or its headers. Outlook's Report button sends the original as an attachment, and this page finds it.

Or choose a saved message (.eml), or drop one on this box

Nothing is uploaded. This page reads what you paste or choose inside your browser. The message isn't sent to abbott.cloud or anyone else, and it isn't kept.

How do I get a message's headers, or save it as a file?

Outlook (desktop): open the message in its own window, choose File > Properties, and copy the box called Internet headers. Outlook saves whole messages as .msg, which this page can't read, so copy the headers instead.
Outlook on the web: open the message, choose More actions (the three dots) > View > View message details, and copy what's shown.
Gmail: open the message, choose the three dots > Show original, then copy the text, or choose Download original to get an .eml file.
Apple Mail: choose View > Message > All Headers, or File > Save As to save an .eml file.
Thunderbird: choose File > Save As > File to save an .eml file, or View > Headers > All.

How this works

If the file is a user report (subject starting Phishing:, Junk:, Not junk:, or 3|, 1|, 2|) with the original attached, this page analyses the original and notes what the user reported it as.
It reads the headers Microsoft 365 adds: X-Forefront-Antispam-Report (category, filtering verdict, connecting IP, country), X-Microsoft-Antispam (bulk level) and the composite authentication result in Authentication-Results. Every code is explained from Microsoft's documentation.
It looks at the message itself: links that say one place and go to another, hidden text, forms, attachment types, look-alike domains, and who replies would go to.
It lists every domain involved (sender, signer, servers, links) with what part each plays, and suggests next steps based on what it found.

What's kept: nothing. If you press "Check registration dates", the domain names you choose are sent through abbott.cloud to the registries' public RDAP servers, and the request log shows exactly what was sent.

Limitations:

The headers record Microsoft's verdict, not what was done about it. Whether a message was delivered, junked or quarantined depends on your policies.
Only the headers added by your own Microsoft 365 organisation can be trusted. Anything earlier in the chain can be forged.
Advice is general. Check it against your own policies and licences: some features need Defender for Office 365.
Outlook .msg files can't be read here. Ask for the message as .eml, or paste its headers.

Code: phishreport.js (this page), mailui.js (the cards), phishreport.js (the findings), msheaders.js (Microsoft codes), maildomains.js (domains), mailparse.js (reading messages).