Email Header Analyzer
Paste the full raw headers from any email to trace the delivery path and check DKIM, SPF, and DMARC authentication results. Parses every hop in the Received chain, calculates per-hop delays, and displays a structured table of all headers. Runs entirely in your browser — your headers are never uploaded.
Paste raw email headers on the left and click Analyze.
About this tool
Every email carries a hidden block of headers that record the full journey from sender to inbox. The Email Header Analyzer parses that raw header dump and presents the information in a clear, structured format.
How to view raw headers
- Gmail: Open the email, click the three-dot menu (top right), and choose "Show original". Copy everything in the top half before the blank line.
- Outlook (web): Open the email, click the three-dot menu, select "View message source", and copy the header block.
- Outlook (desktop): Open the email, go to File > Properties. The headers are in the "Internet headers" box.
- Apple Mail: Open the email, then View > Message > All Headers. Select all and copy.
- Thunderbird: View > Message Source (Ctrl+U / Cmd+U).
What the authentication results mean
- SPF (Sender Policy Framework): Checks whether the sending mail server is authorised to send mail for the "From" domain. A PASS means the server IP is listed in the domain's SPF DNS record. A FAIL is a strong indicator of spoofing.
- DKIM (DomainKeys Identified Mail): A cryptographic signature added by the sending server. The receiving server fetches the public key from DNS and verifies the signature, proving the message was not tampered with in transit. PASS means the signature is valid.
- DMARC (Domain-based Message Authentication, Reporting and Conformance): A policy layer on top of SPF and DKIM. It tells receiving servers what to do when either check fails (none / quarantine / reject) and where to send reports. PASS means at least one of SPF or DKIM aligned with the From domain.
Understanding the delivery path
Each Received: header is added by a mail server as the message passes through it. They are stacked newest-first, so this tool reverses them to show the oldest hop first — the path your email actually travelled. The timestamp diff between consecutive hops shows where delays occurred.
