Email Header Analyzer
Paste an email's headers to see SPF, DKIM and DMARC results, the route it took and delays at each hop.
Gmail: open the email, click ⋮ then "Show original". Outlook: File → Properties → Internet headers. The headers are read in your browser and not sent anywhere.
Authentication
Summary
Delivery path (sender first)
| # | From | By | Protocol | Time | Delay |
|---|---|---|---|---|---|
Email Header Analyzer
Every email carries headers that record where it came from and how it travelled. They answer questions like "is this really from my bank?" and "why did this arrive two hours late?". Paste the headers (or the whole message source) and the analyzer shows the authentication results, the sender details, and each server hop in order with the delay between them. Parsing happens in your browser.
How to use Email Header Analyzer
- Open the email's headers: in Gmail choose "Show original", in Outlook open the message properties, in Apple Mail choose View > Message > All Headers.
- Copy everything and paste it into the box.
- Check the authentication results: SPF, DKIM and DMARC should pass for genuine mail from a well-run domain.
- Look at the delivery path for the hop with the longest delay, and compare the From, Reply-To and Return-Path addresses.
When it comes in handy
- Checking whether a suspicious email is spoofed or phishing.
- Finding where an email was delayed.
- Troubleshooting why your own emails land in spam.
Frequently asked questions
- What is a sign of a spoofed email?
- A DMARC or SPF fail, a Reply-To address on a different domain from the From address, or a first hop from a server unrelated to the sender. None of these proves fraud alone, so be careful with links and attachments.
- Are my headers uploaded?
- No. They are read in your browser. Headers can contain your email address and IP address, so be careful where else you paste them.