Free tool · no signup
Email Header Analyzer
An email header analyzer reads the hidden headers on a message and tells you where it came from, every server it passed through, how long each hop took, and whether SPF, DKIM and DMARC passed. Paste the raw headers here and you get all of that plus the originating IP. Free, no signup, and the message never leaves your browser.
Runs entirely in your browser. Nothing you paste is uploaded, logged or stored.
Paste headers above. Nothing is uploaded — which matters here, because a raw message contains the whole body and every recipient.
- Hop-by-hop delivery route, oldest first, the way the message travelled
- Per-hop delay so you can see which server sat on it
- SPF, DKIM and DMARC verdicts read from Authentication-Results
- Originating IP and sending host, plus Return-Path vs From mismatch
- Decodes RFC 2047 encoded subjects (=?UTF-8?B?…?=)
- Full header table, searchable, with the raw values intact
How to use it
Four steps, about thirty seconds
- 01
Open the original message
In Gmail: the ⋮ menu → Show original. In Outlook: File → Properties → Internet headers. In Apple Mail: View → Message → All Headers.
- 02
Copy the headers
Select everything from the first line down to the blank line before the message body. Copying the whole original is fine too.
- 03
Paste and read the route
The hops are reordered oldest first, with the delay at each one — the slow hop is usually obvious at a glance.
- 04
Check the three verdicts
SPF, DKIM and DMARC are pulled out separately. A DMARC pass is the one that means the From address is genuine.
Where to find them
Getting the raw headers out of your mail client
Every client hides them somewhere different, and most hide them well. Copy everything from the first line down to the blank line before the message body — or just copy the whole original, which this tool handles fine.
| Client | Where | Note |
|---|---|---|
| Gmail (web) | Open the message → ⋮ menu on the message → Show original | The page that opens has a Download Original button, which gives you a .eml. |
| Outlook (desktop) | Open in its own window → File → Properties → Internet headers | The box is small and scrolls; select all inside it. |
| Outlook on the web | Open the message → ⋯ → View → View message details | Read-only dialogue — copy from there. |
| Apple Mail | View → Message → All Headers (⇧⌘H) | Shows them inline above the message. |
| Thunderbird | View → Headers → All, or Ctrl+U for the source | Ctrl+U gives the complete raw message. |
| Yahoo / Proton | ⋯ → View raw message | Proton shows the headers its own servers recorded. |
Reading them
Which half of a header can be trusted
This is the one idea that makes header analysis useful. Each server that handles a message *prepends* its own Received line, so the raw file reads newest-first — the bottom entry is the oldest hop and the top is your own provider. This tool reverses them so the list reads the way the message travelled.
Everything written before the message reached your provider can be forged, including the From line, the Reply-To, and earlier Received headers invented by a sending script. What cannot be forged is what your provider wrote on arrival — its own Received line, and the Authentication-Results it calculated. When those disagree with the rest of the headers, believe your provider.
Authentication
SPF, DKIM and DMARC — what each verdict actually proves
All three can say “pass” and only one of them tells you the message is from who it claims to be.
| Verdict | What it proves | What it does not |
|---|---|---|
| spf=pass | The sending server's IP is authorised by the domain in the envelope sender (Return-Path). | Nothing about the From address you can see. A spoofer sending from their own authenticated domain gets spf=pass. |
| dkim=pass | The message carries an intact signature from the signing domain, and was not altered in transit. | That the signing domain matches the visible From. Signing is cheap; anyone can sign their own mail. |
| dmarc=pass | SPF or DKIM passed AND its domain aligns with the From address you see. This is the one that matters. | That the content is safe or the sender honest — only that the domain is genuinely theirs. |
| dmarc=fail with p=reject | The domain owner has told receivers to bin messages like this one, and it arrived anyway. | Worth attention: either a forwarding path broke the alignment, or the message is a forgery. |
Delays
Reading the delay, and what each kind means
The per-hop delays answer the most common question a header ever gets asked: why did this take three hours? Three patterns cover nearly every case.
A gap of a few minutes at one hop, early on. Usually greylisting — the receiving server deliberately rejected the first attempt and accepted the retry. Normal, and invisible to everyone except you.
A long gap at the last hop before the mailbox. That is the recipient’s own filtering or a full queue on their side. Nothing about your sending caused it and nothing about your sending will fix it.
A gap between the Date header and the first Received. The message sat in the sender’s outbox — a laptop that was asleep, or a client that was offline. The clock on that machine may also simply be wrong, which is why a negative delay occasionally appears.
Next
Related checks
Headers answer “what happened to this one message”. If you have the whole message saved as a file, the EML viewer opens it and shows the same header table alongside the readable body and the attachment list. If you are chasing addresses rather than routing, the email extractor pulls every address out of a pasted message, including the ones buried in the headers.
Questions
Frequently asked
Short answers, including the ones where the honest answer is “this tool can’t do that”.
Open the message, click the three-dot menu at the top right of the message (not the window), and choose Show original. The page that opens contains the full raw message — copy all of it and paste it here.
Keep going
Related free tools
EML Viewer
Open a .
Open toolEmail Extractor
Paste text, HTML, CSV or a whole page and get a clean, deduplicated list of email addresses.
Open toolGmail Search Builder
Build a Gmail search visually — from, subject, dates, size, labels, exclusions — and get the exact query string plus a one-click link.
Open toolAI Emaily does the part this tool can’t: the reply.
A free tool cleans up a list or builds a link. AI Emaily reads the thread, drafts the answer in the voice you set, and waits for one click — across Gmail, Outlook, iCloud and any IMAP mailbox. You approve every send.
Email, finally worthy of your attention.
Start your 7-day free trial. Cancel anytime.
- 7-day free trial
- Cancel anytime
- Every provider