Email Header Analyzer

When an email arrives late, lands in spam, or comes from a suspicious sender, the surest clue is the raw message header. Paste the full header copied from your mail client into this email header analyzer and it lays out a From/To/Subject/Date/Message-ID summary, the path of mail servers (Received hops) the message traveled with per-hop delays, and the SPF, DKIM and DMARC authentication results at a glance.

All analysis runs entirely in your browser and the header content is never sent to any server. Use it to trace delivery delays, check for sender-domain spoofing, and confirm that authentication policies were applied correctly.

Where do I copy the header from?

Most mail services offer a view original option. In Gmail, open the message and choose Show originalfrom the more menu; in Outlook, double-click the message and open the internet headers under File → Properties; in Apple Mail use View → Message → Raw Source. Copy the entire header block and paste it into the box above.

How do I read the Received path?

The Received lines stack up from top to bottom as the message passes through servers, which means thetopmost line is the final receiving server and the bottom one is the original sender. This tool reverses them into sender→recipient (chronological) order and shows, for each hop:

• from / by: which server handed off to which server
• timestamp: when that hop received the message
• delay (seconds): the gap from the previous hop — a large value points to a bottleneck at that step

What SPF, DKIM and DMARC results mean

The Authentication-Results header carries the verdicts the receiving server reached.

• SPF: whether the sending IP is on the domain's allow list (pass is healthy)
• DKIM: whether a signature proves the body/headers were not tampered with
• DMARC: the final verdict combining SPF/DKIM alignment with the domain's policy

When all three are pass, the sender is highly trustworthy. A fail or softfailsuggests spoofing or a misconfigured sending setup, so review the authentication records. Look up the domain's SPF, DKIM and DMARC records individually, or diagnose them at once with Email Deliverability Check.

Authentication result values at a glance

Authentication-Results records each mechanism paired with a verdict, like spf=pass. The same word can mean very different things, so use the table below to tell them apart.

Reading a real header line by line

Suppose the message carries the following Authentication-Results and From:

• From: Billing <billing@mail.shop.com>
• Return-Path: <bounce@sg.mailgun.net>
• Authentication-Results: mx.google.com; spf=pass smtp.mailfrom=sg.mailgun.net; dkim=pass header.d=shop.com; dmarc=pass header.from=shop.com

Interpretation: SPF is a pass for sg.mailgun.net (the Return-Path domain), but that domain differs from the From domain shop.com — so SPF alignment fails. DMARC still passes because the DKIM signature's header.d=shop.com matches the From domain, meaning DKIM alignment passes. DMARC passes when either side aligns, so when you use a third-party sender (Mailgun and the like) it is safer to rely on DKIM alignment than on SPF.

Common pitfall

• SPF checks the Return-Path, not the From — it validates the envelope sender (smtp.mailfrom/Return-Path) domain, not the visible From address. That is why a spoofed From can still produce an SPF pass.
• Don't mistake a Received added by a gateway for the origin — the bottom Received is not always the true sending server, and a hop showing a private IP (10.x / 192.168.x) is just an internal relay inside the organization.