SysAdmin Tools

An email header analyzer reads the hidden metadata attached to every email and turns it into a clear, human-readable report. When you receive a message, your mail client only shows you the From, To, Subject and body — but behind that sits a stack of raw headers recording every mail server the message passed through, the authentication results (SPF, DKIM and DMARC), timestamps for each hop, and dozens of diagnostic fields that reveal exactly how — and whether — the email was delivered legitimately.

This tool parses those raw email headers entirely in your browser. Nothing is uploaded to a server, so you can safely paste headers from sensitive or confidential messages. It rebuilds the full delivery path as a numbered hop timeline, calculates the delay introduced at each mail server, and flags the exact hop where a slow-down or misconfiguration occurred. It reads the Authentication-Results and Received-SPF headers to show whether SPF passed, whether a valid DKIM signature was present, and what DMARC decided — the three signals that determine inbox placement and expose spoofing.

For sysadmins, developers and support teams, header analysis is the fastest way to answer the questions that DNS lookups alone cannot: where did this email actually come from, why was it delayed, and is it genuine or spoofed? Whether you are chasing a bounced message, investigating a phishing report, or auditing email forensics after an incident, pasting the headers here gives you the routing path, authentication verdict, spam indicators and the complete header table in seconds — no signup, no logging, no waiting.

How to Use the Email Header Analyzer

  1. 1

    Open the problem email and copy its raw headers

    In Gmail, open the message, click the three dots (⋮) and choose "Show original". In Outlook, go to File → Properties → Internet headers. In Apple Mail, use View → Message → All Headers. In Thunderbird, use View → Message Source. Select everything from the top of the header block and copy it.

  2. 2

    Paste the headers into the analyzer

    Paste the full raw headers into the large text box. Include everything — Delivered-To, every Received line, Authentication-Results, DKIM-Signature and the From/To/Subject/Date fields. The parser handles folded (multi-line) headers automatically, so you do not need to clean anything up first.

  3. 3

    Click Analyze Headers

    The tool parses the headers instantly in your browser. Nothing is sent to a server, so headers from confidential emails stay private on your machine.

  4. 4

    Review the delivery path and authentication results

    Read the summary, the SPF/DKIM/DMARC authentication badges, and the hop-by-hop delivery timeline with per-hop delays. Check the spam indicators and scan the full header table to trace exactly where the email came from and whether it is genuine.

Understanding Email Header Analysis

Email headers are read from the bottom up. Each mail server that handles a message adds its own Received line to the top of the header block, so the last Received header is the origin and the first is the final delivery server. This analyzer reverses them into chronological order and numbers each mail server hop so you can follow the delivery path from sender to recipient. The delay shown at each hop is the time difference between that server's timestamp and the previous one. Small delays of under a second are normal; a single hop that takes ten seconds or more usually points to a greylisting pause, an overloaded relay, or a queue backlog — the exact place an "email is slow" complaint originates. The Authentication-Results header records the receiving server's verdict on SPF pass/fail, the DKIM signature, and the DMARC policy. SPF confirms the sending IP was authorised, DKIM confirms the message was cryptographically signed and unaltered, and DMARC ties both to the visible From address. When any of these fail on a message claiming to be from a domain you trust, that is a strong signal of email spoofing. The spam indicators — X-Spam-Score, X-Mailer, X-Originating-IP, List-Unsubscribe and sender-platform fingerprints like Mailchimp, Amazon SES or SendGrid — add context about the software and reputation behind the message.
FieldDescription
ReceivedAdded by each mail server the message passes through. Records the sending server, the receiving server and a timestamp. Read bottom-to-top: the lowest Received header is the origin, the highest is the final delivery hop.
Authentication-ResultsThe receiving server's summary of SPF, DKIM and DMARC checks — for example spf=pass, dkim=pass, dmarc=pass. The single most useful line for spotting spoofed or unauthenticated mail.
Received-SPFA dedicated header recording the SPF evaluation result (Pass, Fail, SoftFail, Neutral or None) for the sending IP address against the sender domain's SPF policy.
DKIM-SignatureThe cryptographic signature added by the sending domain. Its presence means the message was signed; the Authentication-Results header states whether that signature actually verified (dkim=pass).
Message-IDA globally unique identifier assigned to the message by the originating server. Useful for correlating a message across logs, support tickets and forensic timelines.
Return-PathThe envelope sender (bounce address) where delivery failure notifications are sent. Often differs from the visible From address, especially for mailing lists and bulk senders.

Advertisement

When to Analyze Email Headers

Tracing why an email was delayed

When a recipient complains an email arrived hours late, the hop timeline shows the delay at every mail server. A single hop with a large gap pinpoints the greylisting pause, queue backlog or overloaded relay responsible — far faster than reading raw logs.

Detecting spoofed and phishing emails

If a message claims to be from your bank or your CEO, the authentication badges reveal the truth. SPF fail, a missing DKIM signature, or DMARC fail on a trusted domain is a strong indicator the email was spoofed and should not be trusted.

Diagnosing email authentication failures

When your own outbound mail is failing SPF, DKIM or DMARC at the receiving end, pasting the headers of a test message shows exactly which check failed and where, so you can fix the DNS record or signing configuration responsible.

Finding the true origin of a message

The lowest Received header and any X-Originating-IP field reveal the real source IP of an email, even when the display name and From address have been forged. Essential for abuse reports and incident response.

Email forensics after a security incident

During an investigation, headers provide a tamper-evident record of routing, timing and authentication. Correlate the Message-ID, hop timestamps and originating IP across multiple messages to reconstruct an attacker's sending infrastructure.

Email Header Analyzer — Frequently Asked Questions

What is an email header?
An email header is the block of metadata attached to the top of every email, above the message body. It records the technical details of how the message was created and delivered: the sender and recipient, the subject and date, a unique Message-ID, every mail server the message passed through (Received lines), and authentication results for SPF, DKIM and DMARC. Your mail client normally hides most of it, but the raw headers can be viewed and analyzed to trace delivery and verify a message is genuine.
How to view raw email headers in Gmail?
Open the email in Gmail, then click the three vertical dots (⋮) in the top-right corner of the message, next to the reply arrow. Choose "Show original" from the menu. Gmail opens a new tab showing the complete raw headers along with SPF, DKIM and DMARC results at the top. Click "Copy to clipboard" or select all the header text manually, then paste it into this analyzer to trace the delivery path and check authentication.
How to view email headers in Outlook?
In the Outlook desktop app, open the email in its own window by double-clicking it, then go to File → Properties. The full headers appear in the "Internet headers" box at the bottom — select all the text and copy it. In Outlook on the web, open the message, click the three dots (…) menu, choose "View" and then "View message details" to see the raw headers. Paste them into this tool to analyze the routing and authentication.
What does email header analysis show?
Email header analysis reveals the complete journey and authenticity of a message. It shows the delivery path as a timeline of mail server hops with the delay at each step, the SPF, DKIM and DMARC authentication results that prove whether the sender was authorised, spam indicators such as spam scores and sending-platform fingerprints, the true originating IP address, and every raw header field. Together these let you trace where an email came from, why it was delayed, and whether it is genuine or spoofed.
How to trace email delivery path?
To trace an email's delivery path, look at the Received headers — each mail server that handled the message adds one. They are stacked newest-first, so the bottom Received line is the origin and the top is the final delivery server. This analyzer reverses them into chronological order and numbers each hop, showing the sending and receiving server, the timestamp, and the delay introduced at that step, so you can follow the message from sender to inbox and spot any slow hop.
What is SPF result in email headers?
The SPF result records whether the sending server's IP address was authorised to send mail for the sender's domain, based on that domain's published SPF DNS record. It appears in the Authentication-Results and Received-SPF headers as pass, fail, softfail, neutral or none. A pass means the IP is authorised. A fail or softfail on a message claiming to come from a domain you trust is a warning sign of spoofing, because an unauthorised server sent it.
What is DKIM signature in email headers?
A DKIM signature is a cryptographic stamp the sending domain adds to a message, stored in the DKIM-Signature header. The receiving server retrieves the domain's public key from DNS and uses it to verify the signature, confirming the message genuinely came from that domain and was not altered in transit. The Authentication-Results header reports the outcome as dkim=pass or dkim=fail. A present, passing DKIM signature is strong evidence the email is authentic and its contents are intact.
How to find if email was spoofed?
Check the authentication results in the headers. If a message claims to be from a trusted domain but shows spf=fail, dkim=fail or a missing DKIM signature, and dmarc=fail, it was very likely spoofed. Also compare the From address against the Return-Path and the originating IP in the lowest Received header — mismatches, unfamiliar sending servers, or a From domain that does not match the authenticated domain all indicate the sender forged their identity and the email should not be trusted.
What does received header mean in email?
A Received header is a stamp added by each mail server that handles a message as it travels from sender to recipient. Every hop adds its own Received line to the top of the header block, recording which server it came from, which server received it, the protocol used, and a timestamp. Because they stack newest-first, reading the Received headers from the bottom up reconstructs the full route the email took, which is the basis for tracing its delivery path.
How to check email delivery time from headers?
Each Received header carries a timestamp for when that mail server handled the message. To find the total delivery time, compare the timestamp on the earliest (bottom) Received header with the one on the latest (top) hop. This analyzer does that automatically: it shows the delay at each individual hop and the total end-to-end delivery time at the bottom of the timeline, so you can instantly see whether a message was fast or held up, and exactly which server caused any delay.

Related Tools

Email Health Checker

Audit MX, SPF, DKIM, DMARC and blacklist status for the sending domain in one report.

SPF Lookup

Inspect the sender domain's SPF record, mechanisms and DNS lookup count.

DKIM Lookup

Check the DKIM public key for a selector to explain a dkim=pass or fail.

DMARC Lookup

Review the DMARC policy that decided how a failed message was handled.

MX Lookup

Verify the mail servers a domain uses to send and receive email.