Email header analyzer
Paste the full headers of an email to see the path it took, where it was delayed, the IP address of the server that originally sent it with its location and reputation, and whether SPF, DKIM and DMARC passed — the way to tell a real message from a forged one. Headers are parsed in your browser and never stored.
Findings
Authentication
Identities
Originating server
Route (oldest hop first)
| Hop | From | Received by | Protocol | Time (UTC) | Delay |
|---|
All parsed headers
Route, delays and authentication come straight from the pasted headers; country, network and blocklist status of hop addresses from the CheckMyIP lookup service. Blacklist check
Paste your email headers
Copy the message's original or raw headers from your mail client (steps below), paste them here and press Analyze. The parser reads the Received chain, authentication results and the usual identity headers; the body is ignored, so you can paste the whole raw message if that is easier.
Route and delays
Each Received header is a hop added by a mail server, newest on top; we list them oldest first with the time between hops. A long delay at one hop means that server queued the message (greylisting, outage, rate limiting). The first hop is the submitting client or server; everything after the first hop that belongs to your own provider is your provider's internal routing.
Sender IP and location
The address in the earliest trustworthy Received hop — the first server outside the sender's own infrastructure that stamped it — is the sending server. We look it up: provider, hosting or residential, country, reverse DNS and blocklist status. A marketing email from a known mail provider's range is normal; a bank email from a residential address or a cloud server in an unexpected country is not. The From header is free text and proves nothing; the sending address and the authentication results below are what count.
SPF, DKIM and DMARC
The Authentication-Results header written by your receiving server records whether the sending server was allowed by the From domain's SPF record, whether the DKIM signature verified, and whether DMARC alignment passed. pass/pass/pass means the message really came from that domain's mail system. fail or none on a message claiming to be from a bank, employer or large service is the classic sign of phishing. Check a domain's published policies with the DNS lookup (TXT records).
How to view full headers
Every client hides the headers by default; here is where they are.
Gmail
Open the message › the three-dot menu › Show original. Copy everything from the box (or use Copy to clipboard).
Outlook
Outlook desktop: open the message in its own window › File › Properties › Internet headers. Outlook on the web and new Outlook: the three-dot menu › View › View message source.
Apple Mail
Select the message › View › Message › All Headers (or Raw Source for the full message).
Yahoo
Open the message › the three-dot More menu › View raw message.
Frequently asked questions
How can I analyze the header of an email?
Paste the raw headers into the analyzer above: it reconstructs the route, finds the originating server and shows the SPF, DKIM and DMARC results — the three things that tell you whether the message is genuine.
How do I view an email header?
Through your client's show original, view source or all headers option; the steps for Gmail, Outlook, Apple Mail and Yahoo are above.
How can I view the full email headers in Outlook?
Outlook desktop: open the message, File › Properties › Internet headers. Outlook on the web: three-dot menu › View › View message source.
How to view email headers in Apple Mail?
Select the message, then View › Message › All Headers. Raw Source shows the complete message including headers.
How to read a header?
Read the Received lines from the bottom up — that is the chronological route — then check Authentication-Results for SPF, DKIM and DMARC, and compare the From address with the Return-Path and the DKIM signing domain. The analyzer does all of this and labels each step.
Headers are processed in your browser and never uploaded; only public hop IP addresses are looked up on our server, and nothing about the message is kept.