Email Header Analyzer
Analyze raw email headers to detect spam sources, routing, and authentication results.
Email Header Input
Email Summary
Authentication Results
Spam Risk Indicators
Email Route Timeline
Server Hops
| Hop | Server | IP | Delay |
|---|
Learn more & FAQ
What does an email header analyzer do?
Every email carries a block of hidden headers that record which servers handled it, when, and whether it passed SPF, DKIM, and DMARC authentication. Paste those raw headers in and this tool parses them into a readable delivery timeline and authentication summary, instead of you reading the raw text by hand.
How to read your results
The route trace lists each server the message passed through in order, with the delay at each hop - a good place to spot an unexpected relay or a slow link. The authentication summary shows the SPF, DKIM, and DMARC verdicts recorded by the receiving server. All three passing means the message's sender and content are verified; any failure is worth investigating against your domain's own DNS records.
Frequently asked questions
Where do I find an email's raw headers?
Most mail clients have a "show original" or "view source" option on an open message (in Gmail it's the three-dot menu → Show original). That reveals the full raw header block above the message body, which you can paste directly into this tool.
Why does an email show multiple "Received" headers?
Each mail server that handles a message on its way to you adds its own Received header to the top of the stack, so reading them from bottom to top retraces the message's exact path - useful for spotting where a delay or misroute happened.
What does it mean if SPF passes but DKIM fails (or vice versa)?
SPF checks whether the sending server is authorized for the domain; DKIM checks whether the message content was cryptographically signed and unaltered. They're independent checks, so a message can legitimately pass one and fail the other - for example when it's forwarded through a server not listed in the original SPF record.
Can email headers be spoofed?
The visible "From" display name and even the From address itself can be forged relatively easily. The Received chain and the SPF/DKIM/DMARC authentication results are much harder to fake, since they depend on actual mail server behavior rather than header text an attacker can type freely.
Why did my own test email fail authentication?
This is often caused by missing or outdated SPF/DKIM/DMARC DNS records for your sending domain, or by sending through a relay that isn't included in your SPF record. The DMARC Analyzer and Email Security Check tools below check those records directly.