Email Header Analyzer
Read SPF, DKIM, DMARC results and the delivery path from email headers.
About this tool
Copy the full headers of an email (Gmail: Show original; Outlook: File → Properties or View message source; Apple Mail: All Headers) and paste them. You'll see the authentication results, decoded sender and subject, warnings about mismatched addresses, and each server hop with its IP, encryption and delay.
What email headers reveal
Every email carries a block of headers recording its journey. Each server that handles a message adds a Received line on top, so reading them bottom-up traces the path from the sender's system to your inbox, with timestamps that show where delays happened and markers showing whether each hop used TLS encryption. Your provider's Authentication-Results header records whether the message passed SPF (the sending server is allowed by the domain's DNS), DKIM (the cryptographic signature is valid) and DMARC (the visible From domain aligns with those checks). A DMARC fail on a message claiming to be from your bank is a strong sign of spoofing. The analyzer also decodes RFC 2047 encoded words (=?utf-8?B?…?=) in the From and Subject lines, and warns when Reply-To points to a different domain, a classic phishing trick. Honest limits: only the headers your own provider added (the topmost ones) are trustworthy, because a sender can forge anything below. Results reflect checks made at delivery time, not live DNS. Many legitimate newsletters use a different Return-Path domain. Headers contain your address and IP information, so this runs entirely in your browser. The SPF record generator, the DMARC record generator and the HTTP headers analyzer are related.
Frequently asked questions
How do I view full email headers in Gmail?
Open the email, click ⋮ (More) → Show original, then copy the headers.
How can I tell if an email is spoofed?
Check the DMARC result: a fail, or a From domain that doesn't match where it came from, suggests spoofing.
Why was my email delayed?
Compare timestamps on each Received hop. The tool shows the delay between hops.
Is anything uploaded or fetched?
No. What you paste is processed in your browser, and nothing is fetched, stored or sent.