📧 Email Header Analyzer

Paste email headers to trace the sender origin, view the delivery path, and check authentication (SPF, DKIM, DMARC) results.

What are Email Headers?

Email headers contain metadata about an email message, including the sender, recipient, subject, date, and importantly — the path the email took from sender to recipient and authentication results.

Key Headers to Look For

From: The displayed sender address (can be spoofed)
Return-Path: The actual bounce address (harder to spoof)
Received: Each server that handled the email (trace the path)
Authentication-Results: SPF, DKIM, and DMARC check results

How to Get Email Headers

Gmail: Open email → Click ⋮ (more) → "Show original"
New Outlook and Outlook on the web: Open email → ⋯ (More actions) → View → "View message details"
Classic Outlook for Windows: Open email → File → Properties → "Internet headers"
Apple Mail: View → Message → "All Headers"
Yahoo: Open email → Click ⋮ → "View raw message"

Authentication Checks

SPF (Pass): Email came from an authorized server
DKIM (Pass): Email signature verified, content not modified
DMARC (Pass): Email passed domain owner's authentication policy

How to Read Email Headers

Every mail server that handles a message adds its own Received: line to the top of the headers. So read them bottom to top: the lowest Received line is where the message entered the mail system, and the top one is your own mail server. A shortened example:

Received: from mx.recipient.example (10.0.0.5) by mailbox.recipient.example; Mon, 20 Oct 2026 09:14:07 +0000   ← 3. your mailbox
Received: from mail.sender.example (192.0.2.41) by mx.recipient.example; Mon, 20 Oct 2026 09:14:06 +0000   ← 2. your provider's inbound server
Received: from [198.51.100.7] by mail.sender.example with ESMTPSA; Mon, 20 Oct 2026 02:14:05 -0700   ← 1. sender's server (first hop)
Return-Path: <bounces@sender.example>
Authentication-Results: mx.recipient.example; spf=pass smtp.mailfrom=sender.example; dkim=pass header.d=sender.example; dmarc=pass header.from=sender.example

The analyzer does this ordering for you, lists each hop with the delay since the previous one, and flags slow hops.

Authentication-Results Explained

spf=pass smtp.mailfrom=… — SPF checked the envelope sender (the Return-Path domain) against the sending server's IP.
dkim=pass header.d=… — the DKIM signature verified; header.d is the domain that signed it.
dmarc=pass header.from=… — SPF or DKIM passed and its domain matched the From address.
ARC-* headers — added by forwarders and mailing lists to record what authentication looked like before they changed the message.

Is This Email Spoofed? Five Header Checks

DMARC fails: dmarc=fail means neither SPF nor DKIM passed for the From domain.
SPF fails for the From domain's sending servers.
The DKIM d= domain is unrelated to the From domain.
Reply-To points somewhere else: replies would go to a different domain from the one in From.
The first Received hop comes from an IP or host that doesn't belong to the claimed sender. Check it with Reverse DNS and the Blacklist Checker.

Frequently Asked Questions

How do I analyze email headers?

Copy the full raw headers ("Show original" in Gmail, "View message details" in Outlook) and paste them in above. The analyzer lists every server hop with its delay and pulls out the SPF, DKIM and DMARC results.

How do I read the Received headers?

From the bottom up. Each server adds its own Received line at the top, so the bottom line is the first hop and the top line is your own mail server.

How can I tell if an email is spoofed?

Check Authentication-Results first: dmarc=fail means neither an aligned SPF check nor an aligned DKIM check passed. Then compare the From domain with the Return-Path and the DKIM d= domain. Unrelated domains are a red flag.

What does "dmarc=fail" mean if SPF passed?

SPF passed for the envelope sender (Return-Path), but that domain doesn't match the From address. DMARC needs SPF or DKIM to pass and match the From domain. See DMARC alignment explained.