Email Header Analyzer
Analyze mail headers: hops, delays and SPF/DKIM/DMARC results.
When an email arrives late, lands in spam, or comes from a suspicious sender, the surest clue is the raw message header. Paste the full header copied from your mail client into this email header analyzer and it lays out a From/To/Subject/Date/Message-ID summary, the path of mail servers (Received hops) the message traveled with per-hop delays, and the SPF, DKIM and DMARC authentication results at a glance.
All analysis runs entirely in your browser and the header content is never sent to any server. Use it to trace delivery delays, check for sender-domain spoofing, and confirm that authentication policies were applied correctly.
Where do I copy the header from?
Most mail services offer a view original option. In Gmail, open the message and choose Show originalfrom the more menu; in Outlook, double-click the message and open the internet headers under File → Properties; in Apple Mail use View → Message → Raw Source. Copy the entire header block and paste it into the box above.
How do I read the Received path?
The Received lines stack up from top to bottom as the message passes through servers, which means thetopmost line is the final receiving server and the bottom one is the original sender. This tool reverses them into sender→recipient (chronological) order and shows, for each hop:
- from / by: which server handed off to which server
- timestamp: when that hop received the message
- delay (seconds): the gap from the previous hop — a large value points to a bottleneck at that step
What SPF, DKIM and DMARC results mean
The Authentication-Results header carries the verdicts the receiving server reached.
- SPF: whether the sending IP is on the domain's allow list (
passis healthy) - DKIM: whether a signature proves the body/headers were not tampered with
- DMARC: the final verdict combining SPF/DKIM alignment with the domain's policy
When all three are pass, the sender is highly trustworthy. A fail or softfailsuggests spoofing or a misconfigured sending setup, so review the authentication records. Look up the domain's SPF, DKIM and DMARC records individually, or diagnose them at once with Email Deliverability Check.