Email Header Analyzer

Every email carries a hidden block of technical headers that record who really sent it, which servers relayed it, and whether it passed the industry's anti-spoofing checks. The Email Header Analyzer parses that raw block and turns it into a plain-language report — the sender and subject, the full delivery path, SPF/DKIM/DMARC results, spam-filter scores, and every header grouped by purpose.

It is built for anyone diagnosing a suspicious message, tracing why a legitimate email landed in spam, or measuring where delivery delays crept in.

How to use it

1. Open the message in your mail client and view its original / raw source. In Gmail this is Show original; in Outlook it is File → Properties → Internet headers; in Apple Mail it is View → Message → Raw Source.
2. Copy the whole header block — everything from the first Received: or Delivered-To: line down to the last X- header.
3. Paste it into the input box. The analysis updates as you type.

The output is split into sections:

• Summary — From, To, Subject, Date, Message-ID, the originating IP address, a one-line authentication verdict, and total delivery time.
• Authentication Results — SPF, DKIM and DMARC, each with its result and a short explanation of what it means.
• Delivery Path (Hop Chain) — each mail server the message passed through, in chronological order, with the time-of-arrival and the delay between hops. Delays over 30 seconds are flagged.
• Spam Analysis — SpamAssassin scores, Microsoft SCL, Barracuda and Gmail signals, plus a simple risk rating.
• All Headers — every parsed header, grouped into Routing, Authentication, Sender/Recipient, Content and Custom/X-Headers.

MIME encoded-word subjects and names (for example =?UTF-8?B?...?=) are decoded automatically so international text reads correctly.

What do SPF, DKIM and DMARC mean?

SPF checks that the sending server is authorized to send mail for the domain. DKIM verifies a cryptographic signature proving the message was not altered in transit. DMARC ties the two together and requires them to align with the visible From address. A pass on all three is a strong sign the sender is genuine; a fail on SPF or DMARC is a common indicator of spoofing or phishing.

How do I read the hop chain?

Read it top to bottom: the first row is the server closest to the sender and the last row is the one that delivered to you. Large gaps between hops usually mean queuing or greylisting rather than a problem with the message itself.

Can it tell me for certain that an email is fake?

No single header proves intent. The From address can be forged, but authentication results, a mismatched originating IP, and a suspicious hop chain together give strong evidence. Treat a failing SPF or DMARC on a message claiming to be from a bank or well-known brand as a serious warning.

Does the tool contact any servers or perform live lookups?

No. It reads only the results already recorded in the headers by the receiving servers; it does not re-run SPF, DKIM or DMARC and does not query DNS.

Privacy

All parsing happens entirely in your browser. Your headers are never uploaded, logged, or sent anywhere — and because email headers can contain private routing details, this tool never includes the pasted content in shareable links.