📧 Email Header Analyzer
Paste the full email headers to see the delivery route, the delay at each mail server, and the SPF, DKIM and DMARC results the receiver recorded.
Paste an email's full headers (in most clients: "Show original" / "View source") to see the delivery path hop by hop with the delay at each server, and the SPF/DKIM/DMARC results the receiving server recorded. It parses the headers in your browser — nothing is uploaded. Note it reads the authentication results already written in the headers; it does not perform live DNS lookups, so it can't re-verify SPF/DKIM/DMARC itself. 🔒 100% client-side.
How the email header analyzer works
Every mail server that handles a message stamps a "Received" header on top, so the headers hold a full record of the delivery path — newest hop first. This tool unfolds the headers, reads each Received line to work out which server passed the message to which, parses the timestamps and computes the delay at each hop (a big delay often points to greylisting or a backed-up queue). It also surfaces the authentication results the receiving server already wrote into the Authentication-Results header — SPF, DKIM and DMARC — plus the key identity headers (From, Return-Path, Message-ID, the DKIM signing domain, and the sending program). It parses everything in your browser; nothing is uploaded.
Important scope: this reads the results that mail servers recorded in the headers — it does not perform live DNS lookups, so it cannot independently re-check SPF, DKIM or DMARC against the sender's current DNS records. That "SPF: pass" comes from the receiving server at delivery time, which is exactly what you want when investigating a message after the fact. Headers can be forged before the first trusted hop, so trust the Received chain only from your own infrastructure inward. Because email headers can contain names, addresses and internal hostnames, doing this locally keeps that information on your device rather than pasting it into a third-party service.
Frequently asked questions
How do I read an email's headers?
In Gmail use "Show original", in Outlook "View" → message source, in Apple Mail "View → Message → Raw Source". Copy everything from the top down to the blank line before the body and paste it in — the tool does the rest.
What does the delivery path / hop delay tell me?
Each Received header is one mail server handing the message onward. The tool orders them oldest-to-newest and shows the time gap between hops. Most hops are near-instant; a delay of minutes usually means greylisting or a queue backlog at that server.
Does this verify SPF, DKIM and DMARC?
No — it shows the SPF/DKIM/DMARC results that the receiving mail server already recorded in the Authentication-Results header at delivery time. It does not do live DNS lookups, so it can't re-verify them now; that would require a server. For investigating a received message, the recorded result is the relevant one.
Can email headers be faked?
The lower Received headers (added before the message reached a server you trust) can be forged by a sender. Only the headers added by your own trusted infrastructure are reliable, so read the chain from your servers inward. From and Reply-To are trivially spoofable — that's what SPF/DKIM/DMARC exist to catch.
What is the DKIM signing domain (d=)?
The DKIM-Signature header's d= tag is the domain that cryptographically signed the message, and s= is the selector used to find its public key. If DKIM passed, it proves the message really came from that domain — which may differ from the visible From address.
Are my headers uploaded?
No — the analysis runs entirely in your browser and nothing is transmitted, so the addresses and internal hostnames in the headers stay on your device. It works offline too.