About Email Header Analyzer — Trace SPF, DKIM & DMARC
Every email carries a stack of hidden headers that record exactly how it travelled from sender to inbox. This email header analyzer reads that raw block and turns it into something readable: a summary of the key fields (From, To, Subject, Date, Message-ID), the full delivery chain of `Received:` hops in the order the message actually took, and the authentication verdicts for SPF, DKIM, and DMARC.
It's the fastest way to debug deliverability problems, confirm a message really came from who it claims, or spot a spoofed sender. Paste the headers, read the hops and the auth results, and you can see where mail was delayed, which server handled it, and whether it passed sender authentication.
Everything runs entirely in your browser. Nothing you paste — and email headers can contain sensitive routing and address data — is ever uploaded or stored.
Features
- Unfolds RFC 822 continuation lines so long headers read correctly
- Traces the full Received: chain in true delivery order (origin → mailbox)
- Surfaces SPF, DKIM, and DMARC results from Authentication-Results
- Pulls the key headers: From, To, Cc, Subject, Date, and Message-ID
- Fully offline — your headers never leave the device
How to use
- Open the raw source of an email and copy the full header block.
- Paste it into the input pane on the left.
- Read the structured summary, delivery chain, and authentication results on the right.
- Copy any individual value with the inline copy button.
Frequently asked questions
How do I find the raw headers of an email?
In Gmail open the message, click the three-dot menu and choose "Show original". In Outlook open the message, then File → Properties (or "View message source"). In Apple Mail use View → Message → Raw Source. Copy everything from the top down to the first blank line.
Why is the first Received header the most recent hop?
Each mail server prepends its own Received: line to the top as it handles the message, so the list reads newest-first. This tool reverses them so the delivery chain reads in the natural order — from the originating server down to your mailbox.
What do SPF, DKIM, and DMARC results mean?
SPF checks that the sending server is authorised for the sender domain. DKIM verifies a cryptographic signature proving the message was not altered. DMARC ties the two together with a published policy. A "pass" on all three is a strong signal the mail is genuine; a "fail" can indicate spoofing or a misconfiguration.
Is it safe to paste email headers here?
Yes. All parsing happens locally in your browser with plain string handling — no network requests are made and nothing is logged or uploaded. You can use it with your network disconnected.
Related tools
Everything runs locally in your browser — your input is never uploaded.