Email Header Analyzer
?About this tool, how to use it, and FAQ▾
What is an email header analyzer?
Every email carries a hidden log of its journey: Received lines for each server hop, Authentication-Results stamped by receiving systems, and identity headers like From, Return-Path, and Reply-To. This analyzer parses raw headers into a readable report — the delivery path in chronological order with timestamps, SPF, DKIM, and DMARC verdicts from every hop that recorded them, and an alignment analysis that compares the authenticated domains against the From domain a reader actually sees.
Analysis runs entirely in your browser — the headers you paste are never uploaded — so it is safe to inspect sensitive or suspicious messages. Each header also gets a plain-language explanation of what it does.
How to use
- In your mail client, find the raw source (Gmail: Show original; Outlook: View message source).
- Copy the full header block and paste it into the analyzer.
- Read the hop-by-hop delivery path to see where the message originated and how it traveled.
- Check the SPF, DKIM, and DMARC verdicts and the alignment section to judge whether the From address is trustworthy.
Frequently asked questions
Are my pasted headers uploaded anywhere?
No. This analyzer runs entirely client-side in your browser; the headers never leave your machine. That makes it safe to use on phishing samples and confidential mail.
How can I tell if an email is spoofed from its headers?
Look for failing or missing SPF, DKIM, and DMARC results, misalignment between the authenticated domain and the visible From domain, a Reply-To pointing somewhere unrelated, and an originating hop that does not match the sender's normal infrastructure. The analyzer surfaces each of these.
Why are Received headers read bottom-up?
Each server prepends its Received line to the top of the message, so the bottom-most line is the origin and the top-most is the final delivery. The analyzer re-orders them chronologically for you, so hop 1 is where the message started.