Email header analyzer

Every email carries hidden headers that record where it came from, which servers handled it, and whether it passed authentication checks. Reading them is the fastest way to investigate a suspected phishing email, find out why a message landed in spam, or see where a delivery delay happened. This analyzer parses raw headers into a readable summary.

How to get the raw headers

• Gmail: open the email, click the three-dot menu and choose Show original.
• Outlook (web): open the message, click the three-dot menu, then View, View message source.
• Apple Mail: View, Message, All Headers.

How to use it

1. Paste the full raw headers.
2. Review the sender details, authentication results and the Received hop timeline.

What to look at

• Received headers: read from bottom to top. The bottom one is the first server that accepted the message. Large time gaps between hops show where delays occurred.
• Authentication-Results: look for spf=pass, dkim=pass and dmarc=pass. A fail on all three for a message claiming to be from your bank is a strong phishing signal.
• From vs. Return-Path vs. Reply-To: phishing emails often show a trusted From name but a Reply-To pointing to an unrelated domain.
• Message-ID domain: it should normally match the sending service.

Privacy

Headers contain email addresses and IP addresses. Parsing happens in your browser, so they are not sent anywhere.