Email Header Analyzer

Headers are the envelope metadata every email carries: who sent it (From, Return-Path), where it's going (To, Cc), how it travelled (one Received line per server hop), and how it was authenticated (Authentication-Results, DKIM-Signature). Mail clients hide them by default, but they contain the full forensic story of a message — delivery path, delays, and whether the sender is who they claim to be.

Gmail: open the message → three-dot menu → "Show original". Outlook (web): three-dot menu → View → View message details. Outlook (desktop): open the message → File → Properties → Internet headers. Apple Mail: View → Message → All Headers. Then copy everything and paste it into the analyzer — including the folded continuation lines.

Each server that handles the message stamps a Received header on top, so they read newest-first — this analyzer reverses them into origin-to-inbox order. A typical line says "from <sending host> by <receiving host> with <protocol>; <timestamp>". The chain shows the message's actual route: originating app, the sender's outbound relays, and your provider's inbound servers.

Partially. The sender controls everything below their outbound server — bottom Received lines, From, Subject can all be fabricated. What they can't forge: the Received headers added by YOUR receiving servers (the top ones), and the receiving server's own Authentication-Results verdict. That's why this analyzer takes auth results from the topmost header and why the top of the hop chain is the trustworthy part.

They're the receiving server's authentication verdicts. spf=pass: the sending IP is authorised by the sender domain's SPF record. dkim=pass: the message's cryptographic signature verified against the sender's published key. dmarc=pass: at least one of SPF/DKIM passed AND aligned with the visible From domain. All three passing is a strong signal the message genuinely came from the claimed domain — fail or none on all three is a red flag.

The per-hop delay column answers exactly this: the gap between consecutive Received timestamps shows how long each server sat on the message. A delay at the first hops means the sender's queue was backed up; a delay at the final hops means the receiving infrastructure (spam scanning, greylisting) held it. Clock skew between servers can make individual numbers slightly off — patterns matter more than single seconds.

Return-Path is where bounces go; From is what the reader sees. Mailing platforms legitimately use their own bounce domains (news.brand.com or even the platform's domain), so a mismatch alone isn't proof of spoofing — but combined with dmarc=fail it's the classic phishing signature. The analyzer flags the comparison so you can judge it in context.

No. This analyzer runs entirely in your browser — parsing, the hop timeline and the auth checks are all client-side JavaScript, and no network request carries your headers anywhere. Headers contain real addresses, server names and IPs, which is precisely why we built it this way. You can verify in your browser's network tab.