Email header analyzer.
Paste the full headers of an email to see the servers it passed through and how long each step took, whether it passed SPF, DKIM and DMARC, and the details that reveal spoofing or explain why a message went to spam. The headers never leave your browser.
- Free, no sign-up
- Runs in your browser. Nothing you enter is sent to us.
How to use the email Header Analyzer
- Open the email and find its headers: in Gmail, ⋮ then "Show original"; in Outlook, File then Properties, or "View message source".
- Copy everything from the top down to the first blank line, and paste it here.
- Check the authentication results: SPF, DKIM and DMARC should all say pass.
- Look at the route for long delays or unexpected servers.
What email headers show
Every email carries a block of technical lines above the message: who it's from, who it's to, and a "Received" line added by every server that handled it on the way. The receiving server also adds the results of its authentication checks. Reading them bottom to top tells you the email's real journey, which can be very different from the friendly name in the From line.
Reading the results
- SPF pass: the sending server is allowed to send for that domain.
- DKIM pass: the message carries a valid signature and wasn't changed on the way.
- DMARC pass: the domain in the From address lines up with SPF or DKIM, so the sender is who it claims to be.
- A Return-Path or Reply-To on a different domain from the From address is a common sign of phishing.
- Long delays between hops usually mean a busy or misconfigured server, or greylisting.
Spotting fake emails
If a message claims to come from your bank or a supplier but DMARC fails, or the earliest Received line shows a server you don't recognise, treat it as suspicious: don't click links or pay invoices from it. If emails claiming to be from your own domain are failing, your domain needs proper authentication. Check it with our SPF, DKIM and DMARC checker, and see whether your server is listed with the email blacklist checker.
About the email Header Analyzer.
How do I find the full headers of an email?
In Gmail, open the email, click the three dots, then "Show original". In Outlook on the web, click the three dots, then View, then "View message source". In Outlook desktop, open the message, then File, then Properties.
Are my email headers sent to your server?
No. The analysis runs entirely in your browser. Nothing you paste is uploaded.
Why are the hops listed bottom to top?
Each server adds its Received line at the top, so the oldest hop is at the bottom. We reorder them oldest first so the route reads naturally.
What does DMARC fail mean?
The From domain didn't align with a passing SPF or DKIM check. Either the email is spoofed, or the real sender hasn't set up authentication properly.
Can headers be faked?
The lines added before the email reached a trusted server can be. The Received lines and authentication results added by your own mail provider can be trusted.
You might also need these.
SPF, DKIM & DMARC Checker
Check a domain's email authentication records, and generate a DMARC record to fix what's missing.
Use the toolEmail Blacklist Checker
Check whether a domain or mail server IP is on Spamhaus, SpamCop, Barracuda and other spam blacklists.
Use the toolReverse DNS Lookup
Find the hostname (PTR record) behind an IP address, and check it points back to the same IP.
Use the toolWant this done for you?
Free tools show you what to fix. We fix it, measure it, and keep it working while you run the business.