Email Header Analyzer
Paste raw email headers to see the full delivery path with per-hop delays, plus the SPF, DKIM and DMARC results. Free, parsed in your browser.
What email headers tell you
When you send or receive an email, every server it touches stamps a Received header onto it, and the receiving provider records whether the message passed SPF, DKIM and DMARC. Read together, those headers are the single most useful forensic trail for "why did this email go to spam?", "why was it late?", or "is this message actually from who it claims?".
This analyzer reverses the Received chain into sender-to-recipient order, calculates the delay at each hop, and surfaces the authentication verdict. If SPF/DKIM/DMARC shows anything other than pass, the fix is on your domain's DNS — verify it with a full health check, your DMARC record, or by reading your DMARC aggregate reports.
Frequently asked questions
- What is an email header analyzer?
- Every email carries hidden headers that record where it came from, every server it passed through, and whether it passed SPF, DKIM and DMARC authentication. This tool parses those headers and lays them out clearly — the delivery path, the delays between hops, and the authentication results — so you can see exactly what happened to a message.
- How do I get the raw headers of an email?
- In Gmail: open the message, click the ⋮ menu, and choose 'Show original', then copy everything. In Outlook: open the message, File → Properties, and copy the 'Internet headers' box. In Apple Mail: View → Message → All Headers. Paste the result into the box above.
- Why did my email arrive late?
- The delivery path shows the timestamp at each server and the delay between them. A large gap on one hop usually means greylisting (a deliberate short delay), a full queue, or a slow relay. The tool flags long total transit times so you can spot where the hold-up was.
- What do SPF, DKIM and DMARC 'pass' or 'fail' mean here?
- They're the authentication results the receiving mail server wrote into the Authentication-Results header. 'pass' means the message was verified as genuinely from your domain; 'fail', 'softfail' or 'none' mean it wasn't fully authenticated — which can send mail to spam or let others spoof you. If you see anything other than pass, run a domain health check to find the fix.
- Is the email I paste uploaded anywhere?
- No. All parsing happens in your browser with JavaScript — nothing is sent to us or stored. For continuous, automated visibility into who is sending as your domain across many clients, our paid DMARC monitoring ingests aggregate reports server-side on your behalf.