Email Header Analyzer
Paste email headers to see the delivery path, delays between servers, and SPF, DKIM and DMARC results. Your work stays on this device whenever possible.
How to use Email Header Analyzer
- Open the email and copy its full headers (in Gmail: More, then Show original).
- Paste them into the box and press "Analyze headers".
- Read the summary and the SPF, DKIM and DMARC results.
- Follow the delivery path hop by hop and look for long delays or unexpected servers.
Worked example
Load the sample: the summary shows the From, Return-Path and Reply-To addresses, SPF, DKIM and DMARC all pass, and the path shows three hops with about 6 seconds between the sending server and Google.
When to use this tool
- Checking whether a suspicious email really came from the company it claims.
- Finding where an email was delayed on its way to you.
Important limitations
Received lines can be forged below the first trusted server, and times depend on each server's clock.
Frequently asked questions
How do I get the full headers?
Gmail: open the message, click the three dots, Show original. Outlook on the web: three dots, View, View message source. Apple Mail: View, Message, All Headers.
How do I read the delivery path?
Received lines are added by each server, newest at the top. The tool reverses them so hop 1 is where the message started, and shows the time spent between hops.
Can headers be faked?
The sender can forge Received lines added before the message reached a server you trust, and the From address itself. Authentication-Results added by your own provider are the reliable part.
Why is a delay shown as clock skew?
Each server stamps its own time. If a server's clock is wrong, the next hop can appear to happen earlier than the previous one.
Is it safe to paste headers here?
Yes. Nothing is uploaded; the headers are read in your browser. They contain email and IP addresses, so avoid pasting them into public forums.