Security Tools
Email Header Analyzer
Paste raw email headers to trace delivery path, timing and SPF/DKIM/DMARC results.
- Free to use
- No sign-up
Working on it…
Running the tool — your results will appear here in a moment.
No results yet
Enter the details above and run the tool to see your results here.
About this tool
Paste the raw headers of a message to see the route it took, how long each hop took and whether it passed SPF, DKIM and DMARC checks — all in a readable table instead of a wall of text.
How to use it
- Open the message in your mail app and copy its full headers ("Show original" in Gmail, "View message source" in Outlook).
- Paste them into the box.
- Run the analysis and read the summary.
What you can learn
- Sender details – From, Reply-To and Return-Path, which can reveal spoofing.
- Delivery path – each server the message passed through, in order.
- Delays – which hop slowed the delivery.
- Authentication – SPF, DKIM and DMARC pass or fail results.
SPF, DKIM and DMARC in brief
SPF lists the servers allowed to send for a name. DKIM adds a cryptographic signature proving the message was not altered. DMARC tells receivers what to do when those checks fail. Messages failing all three deserve extra caution.
When it helps
- Checking a suspicious message before clicking anything
- Finding out why mail arrives late or lands in spam
- Confirming your own domain's authentication is set up correctly
Limitations
Headers can be forged, and IPs often belong to mail providers rather than the actual person. Passing authentication does not guarantee a message is safe, so still treat unexpected attachments and links carefully.
A worked example
An employee receives an "urgent invoice" that appears to come from the CEO. The analysis shows the Reply-To points to a free webmail address, SPF and DMARC fail, and the message entered through an unknown server abroad. It is a spoofing attempt and is reported to IT instead of being paid.
Red flags in headers
- From and Reply-To addresses that do not match.
- Failed SPF, DKIM or DMARC for a well-known company.
- A Return-Path on an unrelated domain.
- Unusual servers or countries for a local business.
Diagnosing slow delivery
Each hop has a timestamp. Large gaps between two hops show where the delay happened — often in spam filtering, greylisting or a busy relay server.
Fixing your own failures
- SPF fail: add the sending service to your SPF record.
- DKIM fail: enable DKIM signing with your provider and publish its key.
- DMARC fail: make sure SPF or DKIM aligns with your From address.
Related tools
- DNS Lookup – check SPF, DKIM and DMARC records
- Blacklist Lookup – check sender reputation
- Suspicious Domain Checker – screen the sender name
Step by step: copying headers in common apps
- Gmail: open the message, click the three dots, choose Show original.
- Outlook (web): click the three dots, choose View → View message source.
- Apple Mail: View → Message → All Headers.
- Thunderbird: View → Message Source.