Email header analyzer
Parse original headers — received hops, auth results, spam score, phishing hints.
Paste the complete header of the email as your mail program shows it under "Show original" or "View source". It is analysed only in your browser.
How this tool works
Every email carries its full journey in the header: every mail server that handed it off (received hops), the authentication results (SPF/DKIM/DMARC), the original sender, date, optional spam scores. The analyzer parses this header purely in the browser — no transmission to any server, safe even for confidential mail. You see hops as an ordered list with delays per hop, auth results color-coded (pass/fail/softfail) and the key header fields (From, To, Subject, Return-Path, Message-ID).
Typical use cases
- Check phishing suspicion — where did the mail really come from, does the From domain match Return-Path?
- On delays, read hop-by-hop latency — where does the mail get stuck?
- In a helpdesk, trace a complaining email
- Verify DKIM selector and domain without decrypting the DKIM signature string
Frequently asked questions
How do I get the header in Outlook/Gmail?
Gmail: open mail, three-dot menu → "Show original". Outlook: File → Properties → "Internet headers". Apple Mail: View menu → "Message" → "All headers".
Why are received hops reversed?
Every mail server puts its received line above the existing ones, so in the raw header the newest hop is at the top and the oldest at the bottom. We reverse this — you see the journey as it happened: first hop at the top, last at the bottom.
What do the auth results tell me?
pass = headers are validly signed/authorised. fail = not authorised, highly suspicious. softfail = per SPF probably not authorised, but the domain does not commit to a hard fail. none = no policy set. DMARC=fail on a supposed bank email — phishing alarm.
Is the header sent to you?
No. Parsing is 100% client-side. Even mails with personal data or confidential content do not leave your machine.
Why is "Authentication-Results" missing?
This header is added by the receiving mail server. If missing, your server did not actively check SPF/DKIM/DMARC — or it is an internally forwarded mail where the result was lost.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.