Email Header Analyzer
Paste an email’s headers to see the servers it passed through, how long each step took, and whether SPF, DKIM and DMARC passed.
- Delivery hops & delays
- SPF, DKIM, DMARC
- Phishing signs
- No upload
Gmail: ⋮ → Show original. Outlook: File → Properties → Internet headers. Apple Mail: View → Message → All Headers.
Authentication
Findings
- OK: SPF passed.
- OK: DKIM passed.
- OK: DMARC passed.
Delivery path · 3 hops · 14 s in total
| # | From | By | Protocol | Time (UTC) | Delay |
|---|---|---|---|---|---|
| 1 | [192.168.1.20] (host-81-2-69-142.example-isp.net. [81.2.69.142])81.2.69.142 | smtp.example.com | ESMTPSA | 2026-10-06 16:14:38 | – |
| 2 | mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])209.85.220.41 | mx.example.org | SMTPS | 2026-10-06 16:14:51 | 13 s |
| 3 | – | 2002:a05:6a10:8f4e:b0:5c1:0:0 | SMTP | 2026-10-06 16:14:52 | 1 s |
Key headers
- From
- Jordan Lee <jordan@example.com>
- Reply-To
- Jordan Lee <jordan@example.com>
- Return-Path
- <jordan@example.com>
- To
- Alex Morgan <alex@example.org>
- Subject
- Q3 report and next steps
- Date
- Tue, 6 Oct 2026 17:14:35 +0100
- Message-ID
- <CAF3x9Ug7k2@mail.example.com>
- Mailer
- Apple Mail (2.3826)
All 15 headers
- Delivered-To:
- alex@example.org
- Received:
- by 2002:a05:6a10:8f4e:b0:5c1:0:0 with SMTP id m14csp221104pxv; Tue, 6 Oct 2026 09:14:52 -0700 (PDT)
- Received:
- from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.example.org with SMTPS id a2si1192820qkb.95.2026.10.06.09.14.51 for <alex@example.org> (Google Transport Security); Tue, 06 Oct 2026 09:14:51 -0700 (PDT)
- Received:
- from [192.168.1.20] (host-81-2-69-142.example-isp.net. [81.2.69.142]) by smtp.example.com with ESMTPSA id k7sm2041951wrx.22.2026.10.06.09.14.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Oct 2026 09:14:38 -0700 (PDT)
- Authentication-Results:
- mx.example.org; dkim=pass header.i=@example.com header.s=s2026 header.b=Xy12abCd; spf=pass (example.org: domain of jordan@example.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=jordan@example.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=example.com
- DKIM-Signature:
- v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=s2026; h=from:to:subject:date:message-id; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=; b=Xy12abCd
- Return-Path:
- <jordan@example.com>
- From:
- Jordan Lee <jordan@example.com>
- Reply-To:
- Jordan Lee <jordan@example.com>
- To:
- Alex Morgan <alex@example.org>
- Subject:
- Q3 report and next steps
- Date:
- Tue, 6 Oct 2026 17:14:35 +0100
- Message-ID:
- <CAF3x9Ug7k2@mail.example.com>
- MIME-Version:
- 1.0
- X-Mailer:
- Apple Mail (2.3826)
What does an email header analyzer do?
Every email carries headers that record its journey: each mail server adds a Received line, the receiving server records Authentication-Results for SPF, DKIM and DMARC, and the sender’s software adds Message-ID, Date and Mailer. Raw headers are long and out of order. This analyzer parses them in your browser, lists the hops from sender to inbox with the delay at each step, shows the authentication verdicts, and highlights warning signs such as failed DMARC, a Reply-To on another domain or a long delivery delay.
How to analyse email headers
- Copy the headers from your email app (see the tips under the box) and paste them, or open an .eml or .msg file.
- Read the Authentication badges for SPF, DKIM and DMARC.
- Follow the delivery path from first to last hop and note any delays.
- Review the findings for phishing or delivery problems.
How to get the headers
- Gmail: open the email, click ⋮ (More) and choose Show original.
- Outlook desktop: open the email, File → Properties, and copy “Internet headers”.
- Outlook on the web: … → View → View message source.
- Apple Mail: View → Message → All Headers. Thunderbird: View → Message Source.
Why use this Email Header analyzer
- Readable delivery pathReceived headers are reversed into hop order with server names, IP addresses, protocols and the delay at each step.
- Authentication at a glanceSPF, DKIM and DMARC results from Authentication-Results, plus DKIM signing domains.
- Phishing signs flaggedFailed authentication, mismatched Reply-To and Return-Path, spam flags and clock problems are explained in plain English.
- Private by designThe email is opened in your browser and never uploaded, which matters for invoices, contracts, HR and legal correspondence.
Common uses
- Phishing checks. Verify whether an email really came from the bank or supplier it claims.
- Delivery delays. Find which server held up a late email.
- Email deliverability. Check SPF, DKIM and DMARC alignment on your own campaigns.
- IT support. Diagnose spam filtering and routing issues.
Related tools: open Word files with the DOCX viewer, combine saved emails with merge PDF, or inspect certificates with the SSL certificate decoder.
Example: a legitimate email
The sample shows three hops from a home network through the sender’s mail server to the recipient, 14 seconds end to end, with SPF, DKIM and DMARC all passing for example.com.
What to expect from the result
The analyzer reads the results recorded in the headers; it does not query DNS or re-verify DKIM signatures. Headers can be forged above the first trusted Received line, so focus on the hops added by your own provider.
Email Header Analyzer questions
How do I read email headers?
Read Received lines from bottom to top: the bottom one is where the email started. This tool reorders them for you and shows the delay at each step.
How can I tell if an email is spoofed?
Check that DMARC passed, that SPF and DKIM passed for the From domain, and that Reply-To and Return-Path match the sender. The findings list highlights mismatches.
What do SPF, DKIM and DMARC mean?
SPF checks the sending server is allowed for the domain, DKIM checks a cryptographic signature from the domain, and DMARC checks that they align with the visible From address.
Why is my email delayed?
Look at the Delay column: a large gap at one hop shows which server held the message, often because of spam filtering, greylisting or a queue.
Are my headers sent anywhere?
No. They are analysed in your browser and nothing is uploaded.