Email Header Analyzer

Paste the message headers to see which servers the email passed through and where it was delayed, what the receiver recorded for SPF, DKIM, DMARC and ARC, whether the From, Return-Path and signature domains align, and any signs of spoofing. Headers never leave your browser.

Open .eml Samples: ·

Headers are parsed by JavaScript in your browser and never sent to our server — we do not see addresses, subjects or IPs. We keep only an anonymous counter (number of hops, SPF/DKIM/DMARC result codes). We do not look up any IP or domain ourselves; the links lead to our checkers if you want to run them.

Key facts

Price: Free
Sign-up: Not required
Processing: In your browser — nothing is sent to our server
Input: Message headers pasted as text (from Gmail, Outlook, Apple Mail, Thunderbird) or an .eml file; the body is ignored
Limits: No daily cap; up to 2 MB of text per run (the first 1 MB of an .eml is read); .msg files are not supported
Output: Received hops with delays and clock skew, SPF/DKIM/DMARC/ARC as recorded by the receiver, From/Return-Path/DKIM d= alignment, DKIM signatures, spam headers, one-click unsubscribe, spoofing signs; the report copies as text
Last updated: 2026-10-13

Alternatives

Other tools for the same job, and what each one does well:

Google Admin Toolbox Messageheader — Google's own tool: normalises the time across all hops and points out where the message was delayed.
MXToolbox Email Header Analyzer — Makes headers human-readable per RFC 822 — hop delays and anti-spam results — next to MXToolbox's other checks (blacklists, DNS).
Microsoft Message Header Analyzer — Microsoft's open-source analyzer: a web version plus an Outlook add-in that reads the headers of the open message for you.

When to choose this tool: When the headers must not go to a third-party service (a client's message, internal mail) — parsing happens in your browser. And when you need to know why DMARC failed: the tool checks From, Return-Path and DKIM d= alignment itself, shows the ARC chain of forwards and verifies one-click unsubscribe.

Descriptions checked against each tool's own site in October 2026.

Online email header analyzer

Email headers are the message’s history: every server on the way adds a Received line, and the receiving server records whether the message passed SPF, DKIM and DMARC. Reading them by hand is slow — lines are folded, the order is reversed and times come in different time zones. This tool lays the Received chain out as hops in chronological order, calculates each step’s delay and the total, flags clock skew and slow hops, shows Authentication-Results, ARC and Received-SPF, the parameters of every DKIM signature, checks the From, Return-Path and DKIM d= domains against each other (DMARC alignment) and highlights spoofing signs: a Reply-To on another domain, a different address in the display name, a spam filter verdict. Everything runs in your browser.

Received hops in time order: sender, receiver, protocol and TLS, delay, clock skew

SPF, DKIM, DMARC, ARC and compauth from Authentication-Results and Received-SPF

From ↔ Return-Path ↔ DKIM d= alignment and DKIM signature details (selector, algorithm, h=, l=)

Phishing signs, SpamAssassin and Microsoft SCL/BCL, one-click unsubscribe (RFC 8058)

Paste from Gmail, Outlook, Apple Mail or drop an .eml; links to check sender IPs and domain

How to Use

Open the message and copy its headers: in Gmail use ⋮ → Show original, in Outlook File → Properties → Internet headers (details in the guide below)
Paste the text into the box or drop an .eml file — analysis starts right away
Start with the verdict and the “What to look at” list, then review the hops and domain alignment

FAQ

Gmail: open the message, click ⋮ at the top right → Show original, then copy everything or click Download original (.eml). Outlook for Windows: double-click the message → File → Properties, the Internet headers box. Outlook on the web and new Outlook: … → View → View message details. Apple Mail: View → Message → All Headers. Thunderbird: Ctrl+U (message source). The iPhone Mail app does not show full headers — use a computer.

No. Parsing is done by JavaScript in your browser; addresses, subject, IPs and server names go nowhere. We keep only an anonymous counter — how many hops and which SPF/DKIM/DMARC result codes. The links to check IPs and domains open our other tools only if you click them.

Each server stamps the time from its own clock. If one of them — or the sender’s computer, which sets the Date header — runs fast or slow, the next hop appears to happen “before” the previous one. It is not a delivery error, but delays around such a hop are unreliable, so the tool marks them as clock skew.

DMARC requires alignment: SPF checks the Return-Path domain, which must match the From domain (or DKIM must pass for the From domain). Email services often put their own domain in Return-Path, so SPF passes but does not count for DMARC. The fix is to sign with DKIM using your own domain or set up a custom return-path domain with the service. The domain alignment table shows which of the two paths failed.

It depends on the job. Google Admin Toolbox Messageheader is good at showing where a message was delayed. MXToolbox parses headers and offers its blacklist checks alongside. Microsoft Message Header Analyzer is handy inside Outlook (there is an add-in) and for Microsoft 365 anti-spam headers. This tool runs entirely in your browser, checks From, Return-Path and DKIM d= alignment itself, shows the ARC chain, one-click unsubscribe and spoofing signs — in English, Russian, Ukrainian and Polish.

How to copy email headers

Mail client	Where to find the headers
Gmail (web)	Open the message → ⋮ at the top right → Show original. Copy everything on that page, or click Download original and drop the .eml file here. The tool skips the summary table above the headers by itself.
Outlook for Windows	Double-click the message → File → Properties → the Internet headers box. Select the text (Ctrl+A) and copy it.
Outlook on the web, new Outlook	… on the message → View → View message details.
Apple Mail	View → Message → All Headers, or View → Message → Raw Source.
Thunderbird	Ctrl+U (⌘U on a Mac) opens the message source.
Yahoo Mail	… on the message → View raw message.

The iPhone Mail app and most mobile clients do not show full headers — open the message on a computer. A copy from your Sent folder is not useful: it has neither the delivery route nor the receiver’s check results yet.

How to read the Received chain

Every server that handles the message adds a Received line at the top. So read them bottom-up: the lowest one is the sender’s first server, the top one is your mailbox. A typical line:

Received: from mail.example.org (mail.example.org [203.0.113.40])
        by mx.google.com with ESMTPS id a1si123
        for <[email protected]>; Wed, 14 Oct 2026 01:20:44 -0700 (PDT)

from — how the sending host introduced itself (HELO); in brackets, its real name from reverse DNS and its IP address. The bracketed IP was written by the receiving server, so it is more trustworthy than the name after from.
by — the server that accepted the message at this step.
with — the protocol: ESMTPS means TLS encryption, ESMTPSA adds sender login, LMTP is local delivery to the mailbox.
id and for — the server’s queue ID and the recipient; an admin can find the message in logs by its ID.
The date after the semicolon is when this server received it, by its own clock.

The tool converts every date to UTC and calculates each hop’s delay relative to the previous one. A few seconds per hop is normal. Minutes or hours usually mean greylisting (the receiving server temporarily refused and the sender retried), a queue on the sending side, antivirus scanning or a resend after an error. A negative delay is not “mail from the future” — it means the clocks of two servers, or of the sender’s computer, disagree.

Keep in mind: Received lines below your own provider’s first server cannot be fully trusted. A spammer can add fake Received lines before sending. The reliable lines are the ones your provider’s servers added — from the top down to where the message reached them.

What SPF, DKIM and DMARC results mean

The receiving server records its checks in the Authentication-Results header. If there are several, the top one comes from the final receiver; the others were added by servers along the way.

Result	Meaning
pass	The check passed.
fail	SPF: the sending IP is explicitly not allowed (`-all`). DKIM: the signature does not verify — the message was changed or the DNS key differs. DMARC: neither SPF nor DKIM passed with an aligned domain.
softfail	SPF: the IP is not allowed, but the domain asks receivers not to reject strictly (`~all`).
neutral, none	The domain asserts nothing (`?all`), or there is no record / the message is unsigned.
temperror	A temporary DNS error during the check — a retry may pass.
permerror	A broken record: for example more than 10 DNS lookups in SPF, or two SPF records.

The tool does not re-verify signatures — that needs the full message and DNS as it was at delivery time. It shows what the receiver recorded and checks domain alignment itself. To test a domain’s records as they are now, use the SPF checker, the DKIM checker (take the selector from s= in DKIM-Signature) and the DMARC checker.

Alignment: why SPF passed but DMARC failed

DMARC only counts SPF or DKIM when their domain matches the From domain the reader sees. SPF checks the Return-Path (bounce address) domain; DKIM checks the signature’s d= domain. In relaxed mode a shared organizational domain is enough (news.shop.com and shop.com); strict mode needs an exact match.

Common reasons for a mismatch:

An email service provider puts its own domain in Return-Path and signs DKIM with its own domain — both checks pass but neither is aligned. Set up a custom return-path domain and DKIM signing with your domain in the provider’s settings.
Forwarding. The forwarding server sends from its own IP, so SPF for the original domain fails. DKIM survives if the message was not modified, and ARC helps: the forwarder seals the results it saw before forwarding.
Mailing lists add a footer or a subject tag, which breaks DKIM. That is why many lists rewrite From to their own address.

How SPF, DKIM and DMARC fit together and how to set them up is covered in SPF, DKIM and DMARC explained.

Phishing signs in headers

DMARC fails or is missing even though the message claims to come from a bank or a well-known service.
Reply-To on another domain, especially free webmail: your reply goes to someone other than the From address.
The display name contains another address: "[email protected]" <[email protected]>.
The first public IP in the chain does not belong to the claimed sender — check it against blacklists and IP geolocation.
A spam filter on the way already flagged it (X-Spam-Status: Yes, or SCL 5+ in Microsoft 365).

No single sign proves forgery, and their absence does not guarantee safety: a hijacked real mailbox passes every check. If a message asks for money, a password or urgent action, contact the sender another way.