🔍 Email Header Analyzer
Paste the raw headers of an email (View Source / Show Original in your mail client) to extract key fields and the chain of Received hops. Everything is parsed locally in your browser — nothing is uploaded.
How the paste is parsed
Nothing is uploaded and no DNS is queried - the whole parse happens in the page. It runs in two passes. First it unfolds, because RFC 5322 lets a long header wrap onto continuation lines that begin with a space or tab:
Received: from mail.example.com
by mx.example.org; Mon, 1 Jan 2024 12:00:05 +0000
becomes one line, then splits at the first ":" into name and valueThen it pulls out From, To, Subject, Date, Message-ID, Return-Path and Reply-To if
present, groups every Authentication-Results header, and lists the
Received hops. Any line without a colon is skipped, so a stray blank or a
fragment of message body does no harm.
Reading the output
- Received hops run newest first. Each server prepends its own line, so Hop 1 is the last machine to touch the message and the bottom hop is closest to the sender. Comparing the timestamps down the chain is how you find a delay.
- Return-Path is not From. The envelope sender in Return-Path is what SPF is checked against; From is what the reader sees. When they differ, that gap is where DMARC alignment succeeds or fails.
- Reply-To deserves a look. A display name matching a colleague with a Reply-To on an unrelated domain is a common phishing shape.
Authentication-Results line proves nothing on its own.Frequently asked questions
How do I get the full headers of an email?
In Gmail open the message menu and choose Show original; in Outlook use File then Properties and copy the internet headers; in Apple Mail turn on View, Message, All Headers. Paste the whole block, headers only.
What does spf=pass dkim=pass dmarc=pass mean?
Your provider verified the sending IP against the SPF record, verified the DKIM signature, and found a domain that lines up with the From: address. All three together say the message really came from that domain - not that its contents are honest.
Can I find the sender's real IP address here?
Sometimes. The lowest Received hop often names the client that first submitted the message, but webmail providers frequently strip or replace it, and every hop before your provider's is unverified.