DARINORCold Lab

Tools / Email Header Analyzer

Email Header Analyzer

Paste raw email headers to trace the Received hop chain and read SPF/DKIM/DMARC results. Parsed entirely in your browser.

In Gmail: message menu → "Show original". In Outlook: message options → "View source" / "Internet headers". Paste everything above the blank line that starts the message body.

Summary
from"Sender Notifications" <notifications@sender.com>
torecipient@example.com
subjectYour weekly report is ready
dateWed, 20 Aug 2026 10:15:10 -0700
return-path<bounce@sender.com>
Authentication
dkim: passspf: passdmarc: pass
Hop chain (3, earliest first)
Hop 1
from smtp.sender.com (smtp.sender.com [198.51.100.5])
by mail-relay.sender.com
with ESMTP
Wed, 20 Aug 2026 10:15:12 -0700
Hop 2+8s
from mail-relay.sender.com (mail-relay.sender.com [203.0.113.10])
by mx.example.com
with ESMTPS
Wed, 20 Aug 2026 10:15:20 -0700
Hop 3+2s
by mail.example.com
with SMTP
Wed, 20 Aug 2026 10:15:22 -0700

// About this tool

Email Header Analyzer

Paste the raw headers from an .eml file, or from your mail client's "show original" / "view source" view, and this tool un-folds continuation lines, extracts the summary fields (From, To, Subject, Date, Return-Path), and walks every Received header to reconstruct the hop-by-hop path the message took — reading bottom-to-top, since each relay prepends its own Received line.

Authentication-Results headers are parsed into individual mechanism=result pairs (spf, dkim, dmarc, and others like compauth or arc) so pass/fail/softfail status is visible at a glance instead of buried in a long header value.

Received header grammar isn't strictly standardized between mail servers, so the from/by/with/id fields shown per hop are a best-effort parse — treat them as a readable summary, and use the raw date to sanity-check the delay figures.

// When to use it

  • Investigate a phishing report

    Paste the reported message's headers to check whether SPF/DKIM/DMARC passed and where the message actually originated versus the displayed From address.

  • Debug slow mail delivery

    The hop chain shows the delay between each Received header — a large gap points to which hop in the delivery path is slow.

  • Verify your own domain's DKIM/SPF setup

    Send yourself a test email, paste the headers, and confirm all three authentication mechanisms show pass.

// Questions

Where do I get the raw headers?

Gmail: open the message, click the ⋮ menu, choose "Show original". Outlook: File → Properties (or message options) → "Internet headers". Apple Mail: View → Message → All Headers.

Is a From/Return-Path mismatch proof of spoofing?

No — it's common and legitimate for mailing lists, ESPs (SendGrid, Mailchimp, etc.), and forwarded mail. It's a signal to look at alongside SPF/DKIM/DMARC results, not a verdict on its own.

Are the headers uploaded anywhere?

No. Parsing happens entirely in your browser — nothing is sent to a server.