Email Header Analyzer
Paste raw email headers to trace the delivery path.
Quick answer
Paste the raw headers of an email and this tool reconstructs its delivery path, listing each mail server it passed through, the time at each hop, and the SPF, DKIM, and DMARC results. It helps you find where a message was delayed, who really sent it, and why it may have failed authentication.
Every email carries a stack of hidden headers that record who sent it, which servers relayed it, and what authentication checks it passed. This tool parses that raw block of text and lays out the delivery path in order, so you can see each hop, the timestamps, and the SPF, DKIM, and DMARC results without reading the headers line by line. It runs entirely in your browser, so the headers you paste never leave your device. Use it to diagnose slow delivery, trace spoofed messages, or confirm your own mail is authenticating correctly.
How to use it
First open the offending message and copy its full source. In Gmail use "Show original", in Outlook open Message Options or the "View source" pane, in Apple Mail choose View > Message > All Headers. Copy everything from the first Received line down to the blank line before the body, then paste it into the box. The tool reads the Received chain, Authentication-Results, and Return-Path fields and reconstructs the journey. Nothing is uploaded; parsing happens locally in JavaScript.
How to read the results
Received lines are listed newest-first in the raw header but the tool orders them by hop, so the top of the path is the originating server and the bottom is your inbox. Compare the timestamps between hops to spot where a message stalled. Check the Authentication-Results block for spf=pass, dkim=pass, and dmarc=pass. A fail or softfail there, or a Return-Path that does not match the visible From address, is a strong signal of spoofing or a misconfigured sending domain.
Why it matters
When a customer says your email never arrived, the headers of a message that did arrive show exactly which relay added delay or which check failed. They are also the fastest way to judge whether a suspicious message is genuine: the friendly From name can say anything, but the Received chain and the authentication results are much harder to forge. Reading them turns a vague deliverability complaint into a specific server or DNS record you can actually fix.
Frequently asked questions
- Are my email headers sent to a server?
- No. The parser runs completely in your browser using client-side JavaScript. The header text you paste is analyzed on your own device and is never transmitted, logged, or stored anywhere. That means you can safely inspect internal or sensitive messages, and the tool keeps working even if you paste headers while offline.
- Which part of the email do I paste?
- Paste only the headers, not the message body. These are the lines above the first empty line in the raw source, starting with fields like Received, Return-Path, Authentication-Results, From, To, and Subject. Use your mail client's "show original" or "view source" option to reveal them; the visible message in your inbox hides most of these fields by default.
- Why are the Received lines in reverse order?
- Each mail server prepends its own Received line to the top of the header as it handles the message, so the raw block reads bottom-to-top: the last line is the original sender and the first line is the final delivery. This tool flips them into chronological order so the path reads naturally from origin to inbox, making stalled hops easier to spot.