Email Header Analyser
Raw headers
Parsed on this server and discarded. Nothing is sent or stored.
Authentication
-
Checks
What the receiving server concluded.
Message
Identity fields from the header block.
Delivery path
Hops in the order they happened, newest last.
Findings
Everything worth a second look.
No headers analysed yet
Paste a raw header block above to see whether the message authenticated and where it came from.
What a header block proves
Headers record what each mail server did with the message on the way in. The Authentication-Results header is the receiving server's own verdict on SPF, DKIM and DMARC. The Received headers are the path, newest first.
A common misunderstanding is that a From address shows the sender. It does not: From is written by whoever composed the message and can say anything. The proof comes from whether SPF and DKIM align with that From domain, which is what DMARC checks.
The three checks in plain language
| Check | Question it answers |
|---|---|
| SPF | Was this IP allowed to send for the envelope domain? |
| DKIM | Is the message signed, and was it altered after signing? |
| DMARC | Does either of those align with the domain the recipient actually sees in From? |
DMARC passing is the one that matters to a recipient. SPF can pass for a completely different domain and the message still fails DMARC, which is the exact pattern used in spoofing.
Reading the delivery path
Each hop shows the server that received the message, the server that passed it on, the protocol and the timestamp. The delay between hops is the time the message spent at that stage.
A long delay usually means greylisting or a queue at the receiving side, not a slow network. A negative delay means a clock on the path is wrong, or a header was inserted after the fact.
Nothing is sent or stored: the pasted block is parsed on this server and discarded with the response.
Frequently asked questions
How do I get the raw headers?
Gmail: open the message, Show original, then copy the block above the body. Outlook: View then Message Details. Apple Mail: View then Message then All Headers.
Does analysing headers prove the email is genuine?
It proves the sending infrastructure was authorised for that domain at that moment. A valid DMARC result is strong evidence, not absolute proof that the content is trustworthy.
Is my header data stored?
No. The block is parsed in memory and the response is discarded. Nothing is written to a database or a log.
Why does DMARC fail when SPF passes?
SPF checks the envelope domain, which the recipient never sees. If that domain differs from the From domain, alignment fails and DMARC fails with it.
What is a DKIM selector?
The label in DNS where the public key lives, at selector._domainkey.domain. The signature names the selector so the receiver can find the key.
Can headers show where the sender really is?
They show the IP addresses of the servers that relayed the message. That narrows the origin to a server, not a person.