Email Header Analyzer

Paste raw email headers and trace the full delivery path. The tool unfolds folded headers, reverses the Received: chain to show hops in chronological order with per-hop delays, parses Authentication-Results for SPF, DKIM, and DMARC verdicts, and surfaces the most useful headers — From, Subject, Return-Path, and Message-ID — in a summary block. Nothing leaves your browser.

How to use the Email Header Analyzer

To get the raw headers:

• Gmail — open the email, click the three-dot menu, choose "Show original" — copy everything above the blank line.
• Outlook — open the email, go to File → Properties — copy the "Internet headers" box.
• Apple Mail — View → Message → All Headers, then copy.

Paste into the textarea and click Analyze. The output shows:

1. Summary — From, To, Subject, Date, Return-Path, Message-ID in a quick-reference block.
2. Delivery path — Received headers reversed into chronological order (oldest hop first). Each row shows the sending host (from), receiving host (by), protocol (with), the timestamp, and the delay from the previous hop. Large delays pinpoint slow relays.
3. Authentication results — SPF, DKIM, and DMARC verdicts colour-coded pass/fail, with the domain and selector where available.

About Email Headers

Every email carries a set of headers describing its origin, route, and authentication status. When you send a message, your mail client adds headers like From:, To:, and Date:. Each mail transfer agent (MTA) that handles the message prepends a Received: header recording its own identity, the host it received the message from, the protocol used, and a timestamp. Because each hop prepends its header, the chain is stored newest-first — the first Received: you see was added by the final delivery server; the last one was added by the sender's outbound relay.

The three email authentication headers tell you whether the message was legitimately sent:

• SPF (Sender Policy Framework) — the receiving server checked whether the sending IP is listed in the v=spf1 DNS record of the envelope sender domain. A pass means the IP is authorized; a fail means it is not, which is a strong indicator of spoofing.
• DKIM (DomainKeys Identified Mail) — the message body and selected headers were signed with a private key. The receiver retrieved the public key via DNS and verified the signature. A pass means the message wasn't tampered with in transit.
• DMARC — checks that the domain in the From header aligns with whichever of SPF or DKIM passed. A DMARC pass means the visible sender is authenticated, closing the loophole where SPF/DKIM can pass on an unrelated domain while the From: header shows a spoofed address.

Analyzing headers is essential for diagnosing spam classification, understanding routing delays, detecting forged sender addresses, and verifying that your domain's email authentication is working end-to-end.

Common use cases

• Spam investigation — determine whether a suspicious message actually came from the domain it claims, by checking SPF, DKIM, and DMARC results and tracing the originating IP.
• Delivery delay diagnosis — identify which hop in the relay chain added unexpected latency by comparing per-hop timestamps.
• Email authentication audit — confirm that your outbound mail passes SPF and DKIM at the recipient's server, closing any authentication gaps before they cause deliverability issues.
• Phishing analysis — compare the From: display name against the Return-Path and the DKIM d= domain to spot header spoofing techniques used in phishing campaigns.
• Support escalation — when a user reports a missing or delayed email, analyzing headers quickly shows whether the message was rejected, queued, or delivered, and where the breakdown occurred.