Email Header Analyzer
Trace email hops and authentication results.
Use the Email Header Analyzer tool
What this email header analyzer does
Email Header Analyzer parses a pasted header block into its individual fields. Received headers are shown oldest to newest with the time each hop added, so a slow relay or an unexpected server stands out. Authentication-Results lines are decoded into separate SPF, DKIM and DMARC outcomes.
Headers are read in this tab and never uploaded. The tool reports what the headers claim; it does not contact the sending server or independently verify a signature. A “pass” in Authentication-Results is the receiving server's opinion, and it can be forged in a header you did not get from a trusted mailbox.
Why use it
- Find which relay delayed a message or rewrote the subject.
- See whether SPF, DKIM and DMARC passed for a newsletter or transactional email.
- Check whether the visible From domain matches the envelope sender.
How to use it
- 1Open the message in your mail client and choose the option to show the original or full headers.
- 2Copy everything from the first header line to the blank line before the body.
- 3Paste it into the analyser and run the check.
- 4Read the hop timeline, then the authentication and address summaries.
Worked examples
Slow delivery
Input
A header where one Received line is two hours after the previous hop
Output
The timeline marks the hop's delay so you can see where the time went.
Authentication summary
Input
An Authentication-Results line with spf=pass, dkim=pass and dmarc=pass
Output
Each mechanism is listed separately with its domain and result.
Common mistakes
- Treating a pass result as proof the message is genuine.
- Pasting the message body instead of the header block.
- Reading Received headers top to bottom; they are added at the bottom and the newest entry is usually first in the file.
Frequently asked questions
Are my headers uploaded?
No. Parsing runs locally in this tab.
Can I see the sender's IP?
Often yes, if the first Received header includes it. Proxies and privacy relays can hide it.
Why are no authentication results shown?
Authentication-Results is added by the receiving provider. If your copy came from an intermediate server, the line may not exist.
Does it verify DKIM signatures?
No. It only reports the result recorded in the headers. Verification requires the public key and the raw signed content.