Tools / Email Header Analyzer
Email Header Analyzer
Paste raw email headers to trace the Received hop chain and read SPF/DKIM/DMARC results. Parsed entirely in your browser.
In Gmail: message menu → "Show original". In Outlook: message options → "View source" / "Internet headers". Paste everything above the blank line that starts the message body.
// About this tool
Email Header Analyzer
Paste the raw headers from an .eml file, or from your mail client's "show original" / "view source" view, and this tool un-folds continuation lines, extracts the summary fields (From, To, Subject, Date, Return-Path), and walks every Received header to reconstruct the hop-by-hop path the message took — reading bottom-to-top, since each relay prepends its own Received line.
Authentication-Results headers are parsed into individual mechanism=result pairs (spf, dkim, dmarc, and others like compauth or arc) so pass/fail/softfail status is visible at a glance instead of buried in a long header value.
Received header grammar isn't strictly standardized between mail servers, so the from/by/with/id fields shown per hop are a best-effort parse — treat them as a readable summary, and use the raw date to sanity-check the delay figures.
// When to use it
Investigate a phishing report
Paste the reported message's headers to check whether SPF/DKIM/DMARC passed and where the message actually originated versus the displayed From address.
Debug slow mail delivery
The hop chain shows the delay between each Received header — a large gap points to which hop in the delivery path is slow.
Verify your own domain's DKIM/SPF setup
Send yourself a test email, paste the headers, and confirm all three authentication mechanisms show pass.
// Questions
Where do I get the raw headers?
Gmail: open the message, click the ⋮ menu, choose "Show original". Outlook: File → Properties (or message options) → "Internet headers". Apple Mail: View → Message → All Headers.
Is a From/Return-Path mismatch proof of spoofing?
No — it's common and legitimate for mailing lists, ESPs (SendGrid, Mailchimp, etc.), and forwarded mail. It's a signal to look at alongside SPF/DKIM/DMARC results, not a verdict on its own.
Are the headers uploaded anywhere?
No. Parsing happens entirely in your browser — nothing is sent to a server.
// Related tools