Email Header Analyzer
Parse email headers to trace the Received chain and read the SPF, DKIM and DMARC verdicts.
Results are provided as is, for general information. Check anything important before relying on it. See the Terms of Use.
About this tool
Reads the header block at the top of an email and lays out what actually happened to it: the Received chain with every hop's sending server, receiving server, protocol and timestamp (most recent hop first, hop count included), the SPF, DKIM and DMARC verdicts pulled out of Authentication-Results as color-coded badges, the Subject with RFC 2047 encoded-words (=?UTF-8?B?...?= and ?Q?...=) decoded, and Message-ID, Return-Path, Reply-To and every remaining header in original order. Parsing happens entirely in your browser — full headers contain internal hostnames and IPs you may not want on a third-party server, and here they never leave this page.
When to use it
Questions
Where do I find the full headers?
Gmail: open the message, ⋮ menu → Show original, copy everything above the body. Outlook: File → Properties → Internet headers, or View message source. Apple Mail: View → Message → All Headers. Paste the whole Name: value block, including the wrapped (indented) continuation lines — the parser unfolds them.
What do SPF, DKIM and DMARC actually verify?
SPF checks that the sending server's IP is authorized by the envelope domain's DNS. DKIM checks a cryptographic signature over (part of) the message. DMARC checks that the visible From domain aligns with whichever of the two passed, and carries the policy. A pass verdict means the mail genuinely came from the domain it claims — it says nothing about whether that domain is trustworthy.
The verdict says spf=pass but the mail is phishing. How?
Attackers send from their own infrastructure, which passes SPF for their own domain, while the From header display name pretends to be your bank. Authentication validates the sending domain, not the intent. Check whether the domains in the Received chain and Return-Path match what the From line claims, and treat mismatched names as the red flag.
Which Received header comes first?
Each server prepends its hop to the top, so the headers read most-recent-first. The bottom Received is the sender's origin; the top one is your mailbox provider accepting it. Reading bottom-up gives the message's actual journey, and the per-hop timestamps show how long each leg took.