Email Header Analyzer

Parse email message headers to trace routing and authentication

Email Headers

Paste email headers

About

Paste a block of email message headers to decode them. Shows key fields (From, To, Subject, Date, Message-ID), the Received hop chain (in delivery order, newest first), and SPF/DKIM/DMARC authentication results from Authentication-Results. Everything runs in your browser; nothing is uploaded.

Examples

Analyze headers from a phishing-suspect email

Input
From: support@paypa1.com
To: user@example.com
Subject: Verify your account
Date: Mon, 1 Jan 2024 09:00:00 +0000
Message-ID: <abc123@mail.paypa1.com>
Authentication-Results: mx.example.com;
  spf=fail (sender SPF failed) smtp.mailfrom=paypa1.com;
  dkim=fail (signature not valid);
  dmarc=fail (domain alignment failed)
Output
From: support@paypa1.com (note: paypa1.com — typosquatting)
Subject: Verify your account
Date: 2024-01-01 09:00:00 UTC
Message-ID: <abc123@mail.paypa1.com>
SPF: FAIL (mismatch)
DKIM: FAIL
DMARC: FAIL
Risk: High — all three auth mechanisms failed; sender domain is typosquatting PayPal

All three authentication mechanisms failing, combined with a typosquatted domain (paypa1.com vs paypal.com), is a strong indicator of a spoofed phishing message.

Trace the Received hop chain

Input
Received: from mail.example.com (mail.example.com [203.0.113.1])
        by mx.recipient.com with ESMTPS id abc123
        (version=TLS1_3...); Mon, 01 Jan 2024 10:00:00 +0000
Received: from client (192.0.2.1) by mail.example.com
        with SMTP id xyz789; Mon, 01 Jan 2024 09:00:00 +0000
Output
Hop 1 (newest): mail.example.com → mx.recipient.com (ESMTPS)
Hop 2: client (192.0.2.1) → mail.example.com (SMTP)
Path: client → mail.example.com → mx.recipient.com

The Received headers are parsed newest-first, showing the path from the sender's client through their mail server to the recipient's mail server.

About this tool

Email headers are the metadata that controls how an email is routed and authenticated — From, To, Subject, Date, Message-ID, and the Received hop chain that traces the email's path through every mail server. They are also where SPF, DKIM, and DMARC authentication results live, giving you evidence about whether a message is genuine or spoofed.

This analyzer parses pasted RFC 5322 email headers, unfolding continuation lines (lines starting with whitespace are joined to the previous line) and stopping at the first blank line which marks the end of the headers. It surfaces the key structured fields, the Received chain in order (newest first), and SPF/DKIM/DMARC results from the Authentication-Results header.

How to use

  1. Paste email headers

    Paste the full headers from an email — in Gmail, click 'Show original'; in Outlook, open the message properties. Stop at the first blank line (the body separator).

  2. Read the parsed fields

    The tool shows From, To, Subject, Date, Message-ID, and all other structured headers, followed by the Received hop chain newest-first.

  3. Check authentication results

    SPF, DKIM, and DMARC pass/fail/none results are extracted from the Authentication-Results header and displayed with a clear status badge.

Use cases

Investigating a suspicious email

Check the From address, authentication results, and Received chain to determine whether an email is likely genuine or a spoofing/phishing attempt.

Debugging email delivery issues

Look at the Received chain to see where an email went wrong — a missing hop or an unexpected server indicates a routing problem.

Verifying SPF/DKIM/DMARC for your own domain

Send a test email to yourself, inspect the headers, and confirm all three auth mechanisms pass so you know your mail server is configured correctly.

Common mistakes

Mistake:Trusting the From address without checking authentication.

Fix:The From header is trivially spoofed. Always check the SPF, DKIM, and DMARC results in Authentication-Results — all three should pass for a trustworthy message.

Mistake:Not checking the Received chain for anomalies.

Fix:Each Received header is added by a mail server and includes its IP address. An unexpected server in the chain can indicate a man-in-the-middle or relay misconfiguration.

Mistake:Misreading the newest-first Received order.

Fix:The most recent Received header (added by the last mail server before delivery) appears first in the list. Older hops are further down. Trace backwards from the top to follow the path.

Frequently asked questions

Related guides

Tracing an Email: Received Headers, SPF, DKIM and DMARC

How the Received chain reveals an email's path, what SPF DKIM and DMARC checks actually verify, and how to spot a spoofed sender address.

References & standards

Related tools

TOML Validator

Validate TOML and re-emit it as clean, indented JSON

TOML to JSON Converter

Convert TOML to JSON and JSON to TOML in either direction

JSON Lines Converter

Convert JSON Lines (NDJSON) to a JSON array and back

CSV to SQL Converter

Generate SQL INSERT statements from CSV data

JSON Schema Validator

Validate a JSON document against a JSON Schema

CSV to Markdown Converter

Convert CSV to a Markdown table and Markdown tables back to CSV