Trace email hops and detect spoofing indicators
The Email Header Analyzer parses the raw headers of any email message and turns them into a readable report. Paste the full header block (everything from the Received, Return-Path, and Authentication-Results lines through Message-ID) and the tool reconstructs the delivery path hop by hop, showing each mail server, its IP address, and the timestamp so you can spot delays or suspicious relays.
It also decodes the results of the three main sender-authentication checks recorded in the headers: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance). Sysadmins, security analysts, and anyone investigating a suspected phishing or spoofed message use it to verify whether an email really came from the domain it claims.
Every mail server that handles a message stamps its own Received header at the top of the stack, so the headers are read bottom to top: the lowest Received line is the sending server and the topmost is the final delivery server. Each line typically records the from host, the by host, the protocol (ESMTP/SMTP), and a timestamp. The tool parses these fields, resolves the delay between consecutive timestamps, and presents the chain in chronological order so a large gap between two hops points to where a message was queued or delayed.
For authentication, the tool reads the Authentication-Results and Received-SPF headers. SPF checks whether the sending IP is authorized in the domain's DNS TXT record and returns pass, fail, softfail, or neutral. DKIM verifies the cryptographic signature in the DKIM-Signature header against the public key published at selector._domainkey.domain, yielding pass or fail. DMARC then requires that SPF or DKIM pass AND that the authenticated domain aligns with the visible From address; a dmarc=pass with alignment is strong evidence the message is genuine, while dmarc=fail on a message claiming to be from a well-known brand is a classic spoofing signal.
In Gmail open the message, click the three-dot menu and choose Show original. In Outlook open the message, go to File then Properties and copy the Internet headers box. In Apple Mail use View then Message then Raw Source.
Yes, it is completely free. The header parsing runs in your browser, so the pasted headers are not stored on a server or shared. Even so, headers can contain email addresses and internal hostnames, so avoid pasting messages you consider sensitive.
An SPF softfail means the sending IP is not listed as authorized but the domain owner asked receivers not to reject outright, so it is a soft warning. A DKIM fail means the signature did not validate, which can indicate the message was altered in transit or forged, though forwarding and mailing lists sometimes break DKIM legitimately.
Each server prepends its Received line to the top of the header block as it handles the message, so the oldest hop (the original sender) is at the bottom and the newest (your mail server) is at the top. Reading bottom to top follows the message's true chronological path.
It gives strong evidence but not absolute proof. A DMARC fail combined with an originating IP that does not match the claimed sender's known infrastructure strongly suggests spoofing. A DMARC pass with proper alignment indicates the sending domain was authenticated by the mail provider.
The delay column is calculated from the timestamps in adjacent Received headers. A large gap usually means the message sat in a queue on that server due to greylisting, rate limiting, or a temporary outage. Note that server clocks are not always synchronized, so small negative or odd delays can occur.
No. It only processes the header text you paste in manually. It never connects to your mailbox and never asks for credentials.