Email Header Analyzer
Paste the raw headers of an email to trace the path it took, see how long each server held it, and read the SPF, DKIM and DMARC verdicts in plain words. Everything is parsed in your browser; nothing is uploaded.
Last updated:
Paste headers above and click Analyze headers, or try the .
Message
Checks
Delivery path
DKIM signatures
All headers
How to use the Email Header Analyzer
- Copy the raw headers. Gmail: open the message, ⋮ menu, Show original. Outlook: File, Properties, Internet headers (or ⋯ View, View message source on the web). Apple Mail: View, Message, All Headers.
- Paste them into the box, or open a saved .eml file. Pasting the whole message source is fine: only the headers are read.
- Click Analyze headers to see the summary, authentication results and warnings.
- Follow the hops from the sender to your mailbox; long delays show which server held the message.
- Check the flags: failing DMARC, a different Reply-To or an unexpected sender domain are common signs of phishing.
Important email headers
| Header | Added by | What it tells you |
|---|---|---|
| Received | Every mail server on the way | Which server passed the message to which, with what protocol, and when. Newest first. |
| Authentication-Results | The receiving provider | SPF, DKIM and DMARC verdicts (RFC 8601). The topmost one is the most trustworthy. |
| Received-SPF | The receiving server | The SPF result and the client IP that was checked |
| DKIM-Signature | The sending domain or service | Signing domain (d=), selector (s=), algorithm (a=) and signed header list (h=) |
| Return-Path | The final server, from the SMTP MAIL FROM | Where bounces go; the domain that SPF checks |
| From / Reply-To / Sender | The sender's mail program | The visible author, where replies go, and who sent on the author's behalf |
| Message-ID | The first mail server or client | A unique ID, useful for finding the message in server logs |
| ARC-* | Forwarders and mailing lists | Authenticated Received Chain: preserves authentication results across forwarding |
How delays are calculated
Every Received header ends with a timestamp after the last semicolon. The analyzer converts each one to UTC using its timezone offset, puts the hops in delivery order (bottom header first) and subtracts consecutive times. The first delay is measured from the message's Date header, which is set by the sender's computer or app. Delays of a few seconds are normal; minutes usually mean greylisting, a busy spam filter or a queue on a sending service; hours often mean the sending server retried after a temporary error.
Spotting a phishing email from its headers
- DMARC fail for a well-known brand domain is a strong warning sign.
- Reply-To on a different domain from the From address, especially a free webmail address.
- A display name with an email address in it, such as "[email protected]" <[email protected]>.
- An origin IP or first hop that has nothing to do with the claimed sender.
- Look-alike domains in From or Return-Path (rn instead of m, extra hyphens, unusual top-level domains).
To see what a domain allows, check its published policy with the SPF Record Checker or look up its _dmarc TXT record with the DNS Lookup.
Frequently asked questions
What are email headers?
Headers are the lines at the top of every email message: who sent it, who it is for, the subject and date, plus technical lines added by each server on the way, such as Received, Authentication-Results and DKIM-Signature. Mail programs hide most of them, but you can view the full source.
How do I read the Received headers?
Each server that handles a message adds a Received line at the top, so the newest hop is first. Reading from the bottom up shows the path from the sender to you. This tool reverses them and calculates the time between hops from their timestamps.
How can I find the sender's IP address?
Look at the oldest Received header that shows a public IP address: that is usually the server or device that handed the message to the first mail server. Webmail services such as Gmail and Outlook.com hide the end user's IP, so you normally see the provider's server instead.
What does it mean if DMARC fails?
DMARC fails when neither SPF nor DKIM passes for a domain that matches the visible From address. It often indicates spoofing, but it can also happen with forwarded mail or a misconfigured mailing service. Treat the message with caution, especially if it asks you to click links or pay.
Why is the Return-Path different from the From address?
Newsletters and transactional email services often use their own bounce domain in the Return-Path so they can process bounces. That is normal if DKIM passes with your sender's domain. A mismatch plus a failing DMARC result is a warning sign.
Why do hop delays show negative or odd values?
Delays are computed from clocks on different servers. If one server's clock is wrong or a header has no timezone, the difference can be slightly negative or too large. Small negative values are usually clock drift, not a problem.
Are my headers sent to a server?
No. The headers are parsed entirely with JavaScript in your browser. Nothing is uploaded or stored, so it is safe to analyze private messages.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.