Email Header Analyzer
Paste the raw headers of an email to trace how it travelled and see whether it passed authentication. The analyzer lays out every mail server hop, the delivery timing, and the SPF, DKIM and DMARC results, so you can tell a genuine message from a spoofed one and work out why mail was delayed. Nothing is stored.
New to this? Read how to read email headers, or the guides on SPF, DKIM and DMARC.
Checking a whole domain instead? Check its DMARC record or run a full domain report.
Frequently asked questions
What does an email header analyzer do?
It parses the raw headers of an email and lays out the delivery path, the authentication results (SPF, DKIM, DMARC), and the key fields such as From, Return-Path, and Message-ID. It reads what the receiving mail servers recorded, so you can see how a message travelled and whether it passed authentication.
How do I get the raw headers of an email?
In Gmail, open the message, click the three-dot menu, and choose Show original. In Outlook, open the message and go to File then Properties, and copy the Internet headers box. In Apple Mail, choose View then Message then Raw Source. Paste the whole block here.
What do SPF, DKIM, and DMARC results mean here?
They are the verdicts the receiving server stamped into the Authentication-Results header. SPF checks the sending server was authorised, DKIM checks the message was signed and unaltered, and DMARC ties those to the visible From domain. A pass on all three is what you want; a fail is worth investigating.
Can this tool tell if an email is spoofed?
It surfaces the signals that expose most spoofing: a failed SPF or DMARC result, and a mismatch between the visible From domain and the Return-Path (envelope sender). A mismatch is not always malicious, since newsletters and mail services legitimately use a different bounce domain, but combined with an authentication failure it is a strong warning.
Is my email data sent anywhere?
The headers are parsed on our server to produce the report and are not stored. The tool does no DNS lookups and makes no external calls; it only reads the headers you paste. Even so, remove anything sensitive before pasting, since headers can contain internal host names and addresses.