Email Header Analyzer

What you can do

• Trace an email's delivery path through every server it passed.
• See where a slow email got stuck, with per-hop delays highlighted.
• Check the recorded SPF, DKIM and DMARC results of a message.
• Spot spoofing and phishing signals in an email's headers.
• Find the sending server's IP address in the Received chain.
• Check whether the From domain aligns with Return-Path and DKIM.
• Decode encoded subject lines and search all headers of a message.

How to use the Email Header Analyzer

1. 1Open the message in your mail client and pick "Show original", "View source" or "View raw message".
2. 2Copy the headers (or the whole raw message) and paste them into the tool.
3. 3Read the summary card: sender, subject, date and the three authentication verdicts.
4. 4Follow the delivery path to see each hop, its IP and how long it took.
5. 5Check the flagged signals and the alignment table when a message feels off.

What the verdicts mean, and where they come from

SPF checks whether the server that delivered the message was allowed to send for the envelope sender's domain. DKIM is a cryptographic signature by the signing domain over parts of the message. DMARC ties one of the two to the From domain people actually see and applies the domain owner's published policy.

The verdicts shown are the ones the receiving servers wrote into the Authentication-Results, ARC-Authentication-Results and Received-SPF headers when the message arrived. A browser cannot run the DNS lookups these checks need, so the tool reports what was recorded rather than re-running anything. Headers low in the chain can be forged by a sender, but the results added by your own mail provider are usually trustworthy.

Reading the delivery path

Every server that handles a message adds a Received header on top of the existing ones, so reading them bottom-up gives the path from the sender to your mailbox. For each hop the tool shows the claimed sending host, its IP where stated, the receiving host, the protocol and the timestamp, and computes the time spent between hops. Delays of a minute or more are highlighted, that is usually where a message sat in a queue. Negative gaps are marked as clock disagreement between servers rather than treated as real timing.

Timestamps and host names in Received headers are claims made by each server. Servers you trust write honest ones, but a spammer's own relay can write anything, so treat the earliest hops with more suspicion than the ones added by your provider.

Honest limits

The tool parses and explains, it does not judge. It cannot re-run SPF, DKIM or DMARC, cannot resolve host names, and does not know a domain's reputation. The signals it flags are patterns that appear in spoofed mail and also, sometimes, in perfectly legitimate newsletters and mailing lists, so use them as pointers for a closer look rather than a verdict on the message.