Email header analysis
Analyze raw email headers: presumed origin IP with geo and risk estimate, the chain of received hops plus SPF/DKIM/DMARC if present.
How this tool works
The email header analysis parses the raw header lines of an email that you copy from your mail client and makes the delivery path visible. It shows the presumed origin IP of the message including a coarse geo estimate and risk signals, the chain of received hops (from which server to which server) plus — if contained in the headers — the authentication results SPF, DKIM and DMARC. This helps trace the origin of a suspicious mail and spot phishing signals. The IP geo data is an estimate; the authentication details come from the headers and are not independently re-verified.
Typical use cases
- Determine the origin IP and country of a suspicious mail
- Trace the delivery path via the received hops and check for anomalies
- Read the SPF/DKIM/DMARC results from the header to spot spoofing signals
- Confirm or dispel a phishing suspicion before reacting to a mail
- Back up support tickets about delivery problems with the concrete header trail
Frequently asked questions
Where do I get the raw email headers?
In most mail clients via an option like "Show original", "View source" or "Show headers". Copy the entire header block and paste it into the field.
How is the origin IP determined?
From the received lines the lowest public IP — closest to the first injecting hop — is determined: per line the connecting IP recorded by the receiving server, not the name the sender introduced itself with (HELO). That is the presumed source; with manipulated headers it can be misleading, so it is a hint, not proof.
What do SPF, DKIM and DMARC indicate?
They are email authentication methods. If they pass, it suggests a legitimate sender domain; if they fail, that is a spoofing or phishing signal. We read the results from the headers if the receiving server recorded them there.
Are the pasted headers stored?
No. The headers are processed for analysis and not stored for tracking purposes. Still, remove sensitive content yourself as a precaution if needed — the page sets no cookies, and our own cookieless reach measurement records no values you enter.
Can the analysis detect manipulated headers?
It makes the path documented in the header visible and can reveal breaks in the hop chain. Since received lines above the first trusted server can be forged, it provides signals and no forensic certainty.
How does it differ from the email header analyzer?
The pure header analyzer parses the trail entirely in the browser. This analysis additionally enriches the origin IP server-side with geo and risk signals — i.e. hop chain plus IP classification.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.