Email Header Analyzer
Visually analyze routing paths and authentication results from raw email headers.
Check SPF/DKIM/DMARC verification results at a glance.
📋 Summary (Basic Info)
🛡️ Authentication Results
🛣️ Routing Path (Received Hops)
| Hop | From (Sender) | By (Receiver) | Time / Delay |
|---|
🔒Header data is not sent to the server.
About Email Header Analyzer
The Email Header Analyzer is a free tool that allows you to visually analyze where an email came from and what path it took simply by pasting the raw headers of the received email.
By decoding the IP addresses and times of relay servers (hops) from the "Received" headers, you can identify the cause of delays and pinpoint the sender. It also extracts the evaluation results (PASS/FAIL) of email authentication like SPF, DKIM, and DMARC from the "Authentication-Results" header—often added when receiving via Gmail or Yahoo! Mail—providing criteria to determine if an email is spoofed or spam.
How to Use
Obtain Headers
Open your email client (e.g., Gmail, Outlook, Thunderbird) and copy the "Show original" or "Raw headers" of the email you want to analyze.
Input Headers
Paste the copied text into the input area of this tool.
Execute Analysis
Click the "Analyze Headers" button. Processing is done locally in an instant.
Check Results
The sender, authentication results (SPF, etc.), and a list of hops will be displayed.
Glossary of Email Headers
- Email Header
- Hidden metadata separate from the email body that records the sender, recipient, subject, send date, and a log of the relaying servers.
- Received Header
- A record of the mail servers (MTAs) the email passed through to reach the recipient. New records are added from bottom to top, making it useful for tracking the route.
- Authentication-Results
- A header where the receiving mail server records the results (like PASS or FAIL) of verifying the sender's legitimacy using email authentication technologies like SPF, DKIM, and DMARC.
- Return-Path (Envelope From)
- The address where bounce messages (delivery errors) are sent back. SPF authentication is performed using this Return-Path domain.
- Message-ID
- A globally unique identifier (ID) assigned to each email. It is used for tracking threads and deduplication.
Frequently Asked Questions
- Q.Are email headers saved on the server?
- No. This tool performs text analysis entirely in your browser (client-side) using JavaScript. Your email headers and content are never sent to external servers.
- Q.Authentication results (SPF/DKIM/DMARC) are not displayed.
- If the server that received the email does not support authentication (e.g., older custom domain mail servers), the Authentication-Results header is not added, and results will not be displayed. Try testing with an email received via Gmail.
- Q.How do I view the email source (raw headers)?
- In Gmail, click "⋮ (More)" in the top right corner, select "Show original", and click "Copy to clipboard". In Outlook, you can copy them from the "Internet headers" section under "Properties".
- Q.Why is the number of Received hops more/less than the actual number of servers?
- Hop counts may vary if a malicious sender adds fake Received headers at the bottom (sender side) to disguise the origin, or due to forwarding by routers within a corporate network.
Use Cases
Investigating Spam/Phishing
When you receive a suspicious email, analyze the headers to check the actual sender IP address or if SPF/DKIM authentication failed, helping you spot fraudulent emails.
Identifying Causes of Email Delays
When facing issues like "slow email delivery," check the time difference (timestamps) between each hop in the Received headers to identify which server caused the delay.
Testing Email Delivery from Your Company
Analyze the headers of test emails sent from your own server or email delivery system (like SendGrid) to confirm that DMARC authentication is correctly resulting in "PASS."
System Development & Debugging
Verify whether the headers of automated notification emails sent from applications are correctly configured and taking the intended route.
Send Feedback
Please let us know your thoughts to help us improve the tool.
Feedback is temporarily suspended
The server is busy or spam protection is active. Please try again later.