Network/HTTP
Email Header Analyzer
Parse raw email headers (View Source / Show Original) — key fields, the Received chain with hop timings, SPF/DKIM/DMARC, From/Reply-To spoofing indicators.
A message's full headers (View Source or Show Original in a mail client) record its entire path through mail servers, along with sender-authenticity check results. This tool breaks those headers down into readable fields and flags signs of spoofing.
How to use it
- Paste raw email headers and the tool extracts the main fields (From, To, Subject, Date) along with the Received chain and the timing of each hop.
- SPF, DKIM, and DMARC results are shown separately with an explanation of what each status (pass, fail, none) means.
- A mismatch between the From and Reply-To headers is flagged — a common sign of phishing.
Common uses
- Checking a suspicious email for signs of phishing before trusting its links or attachments.
- Debugging why a legitimate email lands in spam by checking its SPF/DKIM/DMARC status.
- Tracing an email's actual path through servers to understand a delivery delay.
Things to keep in mind
The Date header is set by the sender's client and can be inaccurate; for an exact timeline, trust the timestamps in the Received chain, which are added by the mail servers themselves.
Passing SPF/DKIM/DMARC only confirms the message is technically authorized by the sending domain — it doesn't guarantee the content itself isn't phishing or spam.
Article about this tool: Email headers: how to trace a message's path from sender to you
Frequently asked questions
What can email headers actually tell me that the message body can't?
Headers reveal the path an email took through mail servers (Received lines), authentication results (SPF, DKIM, DMARC), and the true originating server — useful for spotting spoofed or phishing emails.
How do I tell if SPF, DKIM, or DMARC actually passed?
Look for pass, fail, or none in the Authentication-Results header — a "pass" on all three is a strong (though not absolute) signal the message wasn't spoofed, while failures on sender-critical checks are a red flag.
Does pasting email headers here upload them anywhere?
No. Headers are parsed entirely in your browser — nothing is sent to a server, so it's safe to analyze real headers.
What is the Message-ID header for?
It's a unique identifier for a specific email that mail services use to group a conversation into a thread — when you reply to a message, your client records the original Message-ID in the In-Reply-To header.
Why might the date in the Date header not match the timing of the Received headers?
The Date header is set by the sender's client and can in theory hold any value (including a wrong one from an out-of-sync clock), while the timestamps in Received are added by the mail servers themselves during actual delivery — so Received is the more trustworthy source for reconstructing the exact timeline.