Analyze Email Headers

Read Any Email's Headers in Plain English

Every email carries a hidden block of headers that records exactly how it reached you: the servers it passed through, when each one stamped it, and whether it survived the sender's authentication checks. Paste that raw block here and this tool turns it into something readable — the full Received chain in order from origin to inbox, the time each hop took, the From/To/Subject/Date/Message-ID fields, and the SPF, DKIM, and DMARC results pulled straight from the Authentication-Results line.

It also runs a red-flag pass for you: a display name hiding a different address, a From domain that doesn't match the Return-Path or Reply-To, a failed SPF or DMARC, an unsigned message, or a missing Message-ID. Each finding comes with a plain explanation of why it matters — and why some of them are normal for newsletters and forwarded mail. Unlike header-checker sites that ask you to paste a potentially sensitive email onto their servers, everything here is parsed locally in your browser. Nothing is uploaded, logged, or sent anywhere.

One honest limit: this tool reads the authentication results the receiving mail server already recorded — it does not re-run the cryptographic checks itself, because that needs the sender's DNS records and the raw message body. And clean headers are a strong signal, not a guarantee: a well-configured look-alike domain can pass SPF, DKIM, and DMARC while still being a phishing attempt, so always weigh the results against who you actually expected to hear from.

• Spot phishing and spoofing: Check whether a suspicious "your bank" or "your CEO" email really came from that domain before you click anything.
• Debug deliverability: Find the exact hop that added a delay when your mail is arriving late, using the per-hop timestamps and total transit time.
• Verify authentication before go-live: Confirm SPF, DKIM, and DMARC are all passing and aligned on your own outbound mail after setting up DNS records.
• Trace the originating IP: Identify the first public server a message came from, buried in the earliest Received line.
• Check Reply-To and Return-Path: Catch mail that quietly routes your replies or bounces to a different domain than the one it claims to be from.
• Investigate a reported message: Paste headers a client or coworker forwarded and get a clear, shareable summary of what's trustworthy and what isn't.

Privacy: This runs entirely in your browser. Your email headers are parsed on your device with plain string operations and never leave it — no upload, no server call, no account.