Nowadays developments in information technology are growing rapidly, especially in email. Email became one that almost the whole world had. Email is one of the results of developments in information and communication. Email is widely used to exchange information by sending and receiving data, such as document files, pictures, letters, and others. So much for the crimes that often occur in emails. Email crimes that often occur among them are email spoofing. Email spoofing is a forgery that occurs in the header of the email. So, the email is sent as if it were a valid email. Email spoofing is often used in spamming activities. Crimes committed by cybercrime must leave evidence such as IP Address, sender's email, and time of sending the email. This research will do forensics on email spoofing. The research uses the Live Forensics method, where the computer is used in a powered-on state. The research also uses the NIST (National Institute of Standards Technology) research flow. The email that will be analyzed is in the email header section using 3 tools, namely tracer email analyzer, email dossier, and mail header analysis. This analysis will compare and check the accuracy of the email headers using these tools. Emails suspected of email spoofing will be proven using tools. Based on the 'form' received' and 'Message-ID' headers. Based on the results, the tool that meets the value after the analysis is tracer email analysis.