Email Header Analyzer
Paste raw email headers to trace the Received hop chain and read SPF/DKIM/DMARC results. Parsed entirely in your browser.
In Gmail: message menu → "Show original". In Outlook: message options → "View source" / "Internet headers". Paste everything above the blank line that starts the message body.
About this tool
Email Header Analyzer
Paste the raw headers from an .eml file, or from your mail client's "show original" / "view source" view, and this tool un-folds continuation lines, extracts the summary fields (From, To, Subject, Date, Return-Path), and walks every Received header to reconstruct the hop-by-hop path the message took — reading bottom-to-top, since each relay prepends its own Received line.
Authentication-Results headers are parsed into individual mechanism=result pairs (spf, dkim, dmarc, and others like compauth or arc) so pass/fail/softfail status is visible at a glance instead of buried in a long header value.
Received header grammar isn't strictly standardized between mail servers, so the from/by/with/id fields shown per hop are a best-effort parse — treat them as a readable summary, and use the raw date to sanity-check the delay figures.
When to use it
Investigate a phishing report
Paste the reported message's headers to check whether SPF/DKIM/DMARC passed and where the message actually originated versus the displayed From address.
Debug slow mail delivery
The hop chain shows the delay between each Received header — a large gap points to which hop in the delivery path is slow.
Verify your own domain's DKIM/SPF setup
Send yourself a test email, paste the headers, and confirm all three authentication mechanisms show pass.
Questions
Where do I get the raw headers?
Gmail: open the message, click the ⋮ menu, choose "Show original". Outlook: File → Properties (or message options) → "Internet headers". Apple Mail: View → Message → All Headers.
Is a From/Return-Path mismatch proof of spoofing?
No — it's common and legitimate for mailing lists, ESPs (SendGrid, Mailchimp, etc.), and forwarded mail. It's a signal to look at alongside SPF/DKIM/DMARC results, not a verdict on its own.
Are the headers uploaded anywhere?
No. Parsing happens entirely in your browser — nothing is sent to a server.
Related resources