Paste raw email headers to trace the full delivery path, see every hop with timing, and check SPF, DKIM, DMARC authentication results. Useful for diagnosing deliverability issues and investigating suspicious emails.
Every email contains hidden headers that record the full journey from sender to inbox — which servers handled it, when, and what security checks passed or failed. Here's how to access them in the most common email clients.
Open the email → File → Properties. The headers are in the "Internet headers" box at the bottom. Select all, copy, paste here.
Open the email → click the three dots (⋮) → Show original. A new tab opens with the full source — copy everything above the blank line before the email body.
Open the email → View menu → Message → Raw Source. Select all, copy, paste here.
Open the email → click the three dots (⋯) → View → View message details. Copy the text that appears.
Full hop-by-hop timeline showing every server the email passed through, timestamps, and time spent at each hop — useful for spotting delays.
SPF, DKIM and DMARC authentication results, spam score if present, sender/From domain mismatch detection, and plain English findings.
Flags unusual relay chains, mismatched domains, failed authentication, and other indicators that an email might not be what it claims to be.
Headers are analyzed entirely in your browser. Nothing is uploaded, logged or stored anywhere.
Every email you send or receive carries a set of hidden headers — a detailed technical record of the email's journey from the sender's mail server to your inbox. These headers are invisible in normal email clients but contain critical information: which servers handled the email, when, how long each hop took, and whether the email passed security checks like SPF, DKIM and DMARC. When something goes wrong with email delivery, these headers are the first place any experienced IT professional looks.
In day-to-day IT support, email header analysis comes up in several common scenarios. A user reports an important email never arrived — the headers show whether it was rejected, quarantined, or delayed at a particular relay. A business is receiving phishing emails claiming to be from a trusted supplier — the headers reveal the true sending IP address and whether SPF authentication passed or failed. An email campaign is landing in spam — the headers show which spam filter scored it and why. Without reading the headers, these problems can take hours to diagnose by guesswork.
The Received headers are the most important for delivery tracing. Each server that handles an email adds its own Received header, stamped with the time. Reading them from bottom to top gives you the complete delivery chain — from the originating server through any relays to the final destination. Unusually long gaps between hops often indicate greylisting (a spam prevention technique that temporarily rejects unknown senders), server queuing issues, or filtering delays.
The Authentication-Results header is added by the receiving mail server and summarises the outcome of SPF, DKIM and DMARC checks.
A result of spf=pass dkim=pass dmarc=pass means the email is
almost certainly legitimate. Any failure in this chain is a red flag worth investigating — particularly for emails requesting payments, credential changes, or sensitive information.
Phishing emails are designed to look legitimate — the From display name might say "Barclays Bank" or "Microsoft Support" but the actual sending infrastructure tells a very different story. Headers can reveal this immediately. Key things to look for: does the envelope sender (Return-Path) match the From address? Does the sending IP address belong to the organisation it claims to be from? Did DKIM pass, and was the DKIM signature from the claimed sending domain? A mismatch between any of these is a strong indicator of spoofing or impersonation.
The Reply-To header is another common phishing tell. Attackers often set a legitimate-looking From address but a different Reply-To pointing to a mailbox they control. This means the email appears to come from a trusted source, but any reply goes directly to the attacker. This tool flags Reply-To mismatches automatically in the Security Analysis tab.
Some headers can be forged — particularly the From display name and some of the Received headers added by the sender's own infrastructure. However, headers added by intermediate and receiving servers cannot be forged, which is why the Authentication-Results header (added by the receiving server) is the most trustworthy. SPF, DKIM and DMARC results are based on cryptographic checks that are extremely difficult to fake.
Most emails pass through several servers — the sender's mail client, their outbound mail server, possibly one or more relay servers, and finally the recipient's inbound mail server. Cloud email platforms like Microsoft 365 and Google Workspace add their own processing hops. Each adds a Received header. Three to five hops is completely normal for a modern cloud email journey.
A significant delay at a particular hop usually means the email was queued or held at that server. Common causes include greylisting (the server temporarily rejected the email to filter spam), rate limiting, spam scoring that put it in a review queue, or simply high server load. Delays of a few minutes are normal. Delays of hours suggest the email hit a spam filter or the server had a problem.
Yes — this tool runs entirely in your browser. Your headers are never sent to any server or stored anywhere. The analysis happens locally on your device. That said, avoid pasting headers from emails containing highly sensitive personal or financial information in any public setting.