Paste headers above, or load the example.
Private: everything is read in your browser. Nothing is sent or looked up. Not a spam verdict: the checks show what the servers wrote down, and headers can be forged.
About the email header analyzer
Every email carries a block of hidden lines called headers. They tell you who sent the mail, which servers passed it on, when each server got it, and whether the sender passed the safety checks.
Most mail programs hide them. Paste the headers, or open an .eml file, and you get a clear page: a summary, the SPF, DKIM and DMARC results, the route with the delay at each step, and the sender's IP address.
Features
- Summary — From, To, Subject, Date, Message-ID, Return-Path and Reply-To, with a warning when the domains do not match
- SPF, DKIM, DMARC — a pass, fail or neutral badge for each, with the reason the server wrote
- Route — every Received line, in the order the mail travelled, with the time and a delay bar
- Delays — time zones are handled, and slow or backwards steps are marked
- Sender IP — the first public IP in the route; private addresses are skipped
- Decoded text — names and subjects written as =?UTF-8?B?…?= or =?UTF-8?Q?…?= are shown as normal text
- X-headers — X-Mailer, X-Spam, List-Unsubscribe and more in one table
- Copy or download — take the report with you
How to use it
- Get the headers of the mail (see the steps below)
- Paste them into the box, or press Open .eml file
- Read the summary and check the warning boxes
- Look at the SPF, DKIM and DMARC badges
- Follow the route from the first server down to the last
- Press Copy report to keep the result
How to get the headers
| Program | Steps |
|---|---|
| Gmail | Open the mail. Click the three dots. Choose Show original, then Copy to clipboard. |
| Outlook (Windows) | Double-click the mail. Choose File, then Properties. Copy the Internet headers box. |
| Outlook (web) | Open the mail. Click the three dots. Choose View, then View message details. |
| Apple Mail | Open the mail. Choose View, then Message, then All Headers. Or choose Raw Source. |
| Thunderbird | Open the mail. Press Ctrl+U (Cmd+U on Mac) to see the source. |
You can paste the whole message. The tool stops reading at the first empty line, where the body starts.
How to read the route
Each server that handles the mail adds one Received line at the top. So the raw headers read newest first. This tool turns them around: step 1 is where the mail started, and the last step is your own server.
For each step you see which server sent it (from), which server took it (by), the protocol (with), the IP and the time. The delay is the time between one step and the one before it.
- A few seconds is normal
- More than a minute is marked as slow. Reasons: a busy server, a virus scan, or greylisting
- A negative delay means two servers have different clocks. It does not mean the mail went back in time
What SPF, DKIM and DMARC mean
| Check | What it asks |
|---|---|
| SPF | Is this server allowed to send mail for the Return-Path domain? |
| DKIM | Does the signature match, so the message was not changed on the way? |
| DMARC | Does SPF or DKIM match the From domain? |
The result is written by your mail server, in the Authentication-Results header. This tool shows it. It does not run the checks again, because that needs a live look-up of DNS records. A pass is a good sign. A fail is a reason to be careful, but it is not proof of anything alone.
Frequently asked questions
How do I trace where an email came from?
Look at the sender IP box and the route. The first public IP in the route is the best clue for where the mail started. It is often the IP of the sender's mail provider, not of the person.
Can I find the real location of the sender?
Rarely. Most mail goes out through a provider such as Gmail or a company server, so the IP shows that provider. Some webmail services also add an X-Originating-IP header, but it can be wrong.
What if SPF fails but the mail looks real?
Mail sent through a forwarding service or a mailing list often breaks SPF. If DKIM still passes, the mail is usually fine. Look at the DMARC line too.
Why is the From domain different from the Return-Path?
Newsletter and shop tools send mail for you with their own Return-Path. That is normal. But forged mail also looks like this. Check that DKIM passes for the From domain.
Can I forge headers?
Yes. A sender can write any text in the lines the sender adds. Only the lines added by servers you trust, near the top, are reliable.
Does this tool send my headers anywhere?
No. Everything is read in your browser. There is no look-up and no upload.
Good to know
- This is not a spam or scam verdict. Use it to learn what happened, then decide
- Headers can hold private data such as IP addresses and names. Remove them before you share a report
- Times are shown in UTC
- Very long .eml files are fine; only the first 1 MB is read
Related tools
- Extract Emails and URLs — pull addresses and links out of any text
- What Is My IP — see your own IP address
- Text Diff — compare two sets of headers
- Timestamp Converter — turn a date into a Unix time and back
- Base64 Encode and Decode — decode a Base64 part by hand
