Email Header Analyzer
Paste raw email headers to see the delivery path hop by hop with delays, the SPF, DKIM and DMARC results, and whether the From and Return-Path domains align.
Free · No sign-up · Your inputs stay in your browser
Input
Analyse email headers
Output
12 headers, 3 hops, 8 s in transit
| From | "Example" <[email protected]> |
|---|---|
| Return-Path | <[email protected]> |
| Subject | Your invoice for September |
| Date | Wed, 01 Oct 2026 16:00:00 +0000 |
| Message-ID | <[email protected]> |
| SPF / DKIM / DMARC | pass / pass / pass |
| DKIM signed by | d=example.net s=mail2026 |
| From vs Return-Path domain | same |
| # | From | By | Protocol | Time (UTC) | Delay |
|---|---|---|---|---|---|
| 1 | app-1.internal [10.0.0.12] | smtp.example.net | ESMTPSA | 16:00:01 | - |
| 2 | mail-sor-f41.google.com [209.85.220.41] | mx.google.com | SMTPS | 16:00:07 | 6 s |
| 3 | - | 2002:a05:6a10:1234 | SMTP | 16:00:09 | 2 s |
Received headers are added at the top by each server, so they are read bottom-up: the oldest hop is the sender. Only the hops added by your own provider can be trusted; anything below them could have been written by the sender. A large delay between two hops points at the server that held the message.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Reading Received headers
Each server prepends a Received header, so they read bottom-up, and only the ones added by servers you trust are reliable: anything below your provider's first header could be forged by the sender. A long gap between two hops points at the server that held the message, often a spam filter or a queue under load. RFC 5322 defines the header format.
Where to get the headers
Gmail: the three-dot menu, Show original. Outlook: File, Properties, or View message source on the web. Apple Mail: View, Message, All Headers.