A message carries a delivery path, a set of authentication results, a sending domain that often is not the one in the from line, links whose text and destination need not agree, attachments whose declared type need not match their contents, and images that report back when the message is opened. Mail clients show you almost none of it. Drop a saved message here and it is taken apart, offline.
Drop a saved message here. Most mail programs save one as .eml; Outlook calls it "Save as" and Gmail calls it "Download message".
Read downwards: the oldest hop first, each one written by the server that received it. Only the hops added by servers you trust can be relied on, because anything before that was written by the sender.
The text as it was written, with nothing fetched and nothing run. The HTML version is shown as text rather than rendered, on purpose.
The from line is a claim, not a fact. Nothing stops a message saying it is from anyone. What can be checked is whether the sending server was allowed to send for that domain, whether a signature over the message matches, and whether the domain that signed it is the domain in the from line. Those three are SPF, DKIM and alignment, and they are the difference between a name and an identity.
The delivery path is written by each server as it goes. Every hop is added at the top by the machine that received the message, so the list reads oldest first from the bottom. The ones added by servers you control are trustworthy; everything below them was written by whoever sent the message and can say anything. A path that reports impossible timings, or an internal name you do not recognise, is worth stopping at.
A link's text and its destination are different things. Written text saying one domain while the link goes to another is the oldest trick there is, and it works because no mail client shows both at once. Every link here is listed with what it says and where it goes, and the ones that disagree are marked.
An image in an email is a request to somebody's server. Loading one tells the sender the message was opened, roughly where from, on what, and when, and a one-pixel invisible image exists for no other purpose. Everything the message would fetch is listed here without fetching any of it.
It happens in this tab. A saved message contains the whole of a private conversation, its attachments and the addresses of everyone on it. Uploading that to a website to find out whether it is a phishing attempt would be a strange way round. Turn the network off and this page works exactly as it does now.
In Gmail, open the message, use the menu at the top right of it and choose Download message. In Outlook, File then Save as. In Apple Mail, File then Save As and pick Raw Message Source. Thunderbird has Save As directly. All of them produce the same thing: the message exactly as it arrived.
SPF says the server that sent it was allowed to send for that domain. DKIM says a signature over the message matches a key published by a domain. DMARC says the domain in the from line matches one of those two and the domain owner asked for that to be required. A pass on all three does not mean the message is honest, only that it is genuinely from where it says.
It can tell you the things phishing attempts have in common: a from address that does not match what signed the message, a display name pretending to be an address, links whose text and destination disagree, a reply address on a different domain, attachments that are not the type they claim. Whether a particular message is one is a judgement, and this gives you what the judgement needs.
No. Nothing is fetched, and the HTML is shown as text rather than rendered. That is the whole point of looking at a suspicious message here rather than in a mail client.
Because the declared type and the actual first bytes of the file disagree. Something named as a document that begins with the bytes of a program is the clearest signal there is, and mail clients show only the name.