Email Header Analyser
Parse raw email headers and trace the delivery path.
Paste the raw headers from an email and see who really sent it. This tool reads the From, Return-Path and Received chain, checks the SPF, DKIM and DMARC results, and works entirely in your browser. Nothing is uploaded or stored.
The Email Header Analyser reads the raw headers from a message you have received and lays out the delivery path in plain English. It parses each Received: hop, the From, Return-Path and Reply-To addresses, and the authentication verdicts your provider stamped on the message in the Authentication-Results header.
Why headers matter
Headers are the audit trail of an email. Reading them tells you which servers handled the message, how long it spent at each hop, and whether SPF, DKIM and DMARC passed. This is the fastest way to diagnose why a legitimate message landed in spam, or to judge whether a suspicious message is spoofed. A genuine message normally shows dkim=pass with a signing domain that aligns with the visible From address, and a DMARC pass verdict.
Reading the result
Work from the bottom Received line upward. The lowest hop is usually the originating server, and the top hop is your own inbox. Watch for these red flags:
- Authentication failures:
spf=fail,dkim=failordmarc=failnext to a domain that should be trusted. - Mismatched domains: a
Fromaddress that does not align with the DKIMd=signing domain or theReturn-Path. - Unexpected relays: hops through servers that have nothing to do with the sender.
If your own mail is failing, fix it at source: publish or correct SPF, DKIM and DMARC records and confirm alignment. Our audit guide walks through it, and DMARC Engine can run enforcement for you if you would rather not manage records by hand.
Frequently asked questions
Where do I find the raw headers in my email client?
In Gmail open the message, click the three-dot menu and choose Show original. In Outlook open the message and use File > Properties (desktop) or View message details. In Apple Mail use View > Message > Raw Source. Copy everything from the top down to the blank line before the body.
How do I read the Received headers to trace the path?
Each Received: line is one hop, added at the top as the message travels, so the oldest hop is at the bottom. Read upward from the bottom to follow the message from the sending server to your inbox, and check the timestamps to spot any unusual delays.
What does Authentication-Results tell me?
It records the verdicts your receiving server reached for SPF, DKIM and DMARC, for example dkim=pass or dmarc=fail. These are stamped by the receiver, not the sender, so they are a reliable signal of whether the message was authenticated on arrival.
Does a passing header guarantee the email is genuine?
No. SPF and DKIM only prove the message was authorised by some domain; they do not prove the sender is trustworthy. Check that the authenticated DKIM d= domain and the SPF-checked domain actually align with the brand shown in the From address before you trust it.
Why does my legitimate email show dmarc=fail?
DMARC requires that a passing SPF or DKIM identifier aligns with the From domain. Forwarding can break SPF alignment, and sending through a third party that signs with its own domain can break DKIM alignment. Adding a properly aligned DKIM signature for your own domain usually resolves it; see our enforcement guide.
Is this analyzer safe to use with private headers?
Headers can contain internal server names and IP addresses, so treat them as sensitive. The tool parses what you paste to show the delivery path and verdicts; remove any details you are not comfortable sharing before pasting if the message is highly confidential.