Home / Email Header Analyzer
Email Header Analyzer
Paste an email's raw headers to trace the servers it passed through, find the sender's IP, and read its SPF, DKIM and DMARC results.
About Email Header Analyzer
An email header analyzer turns the raw headers of a message into something readable. It lists every Received line in the order the message travelled, with the time each server added and the delay between hops, finds the first public IP address so you can look up where the message came from, and reads the SPF, DKIM and DMARC verdicts that the receiving server recorded. It also flags common signs of phishing, such as a Reply-To that differs from the sender. Everything runs in your browser.
How to read email headers
Each mail server that handles a message adds a Received line at the top, so the newest hop is first and the original sender is at the bottom. The analyzer reverses them into travel order and works out the delay between hops from their timestamps. A long delay usually means a server queued the message, often because of spam filtering or a busy relay.
Signs of a spoofed or phishing email
- dmarc=fail, or spf=fail together with a DKIM failure, in Authentication-Results.
- A Reply-To address on a different domain from the From address.
- A Return-Path domain that has nothing to do with the brand in the From name.
- An originating IP on a residential or hosting network for mail that claims to come from a large company. Check it with our IP reputation check.
To check the sending domain's own setup, run the DMARC checker.
Sources: RFC 8601 (Authentication-Results), RFC 5322 (Internet Message Format, trace fields).
Frequently asked questions
How do I get the full headers of an email?
In Gmail, open the message, click More (the three dots) and choose Show original. In Outlook on the web, open the message, choose More actions, then View, then View message source. In Apple Mail, choose View, Message, All Headers. Copy everything above the message body and paste it here.
How do I find the sender's IP address from email headers?
Read the Received lines from the bottom up. The lowest one added by the recipient's server names the server that handed over the message, usually with its IP in brackets. The analyzer lists every hop in order and marks the first public IP it finds.
What do spf=pass, dkim=pass and dmarc=pass mean?
They are the receiving server's verdicts, recorded in the Authentication-Results header defined in RFC 8601. SPF checks that the sending server was allowed to send for the envelope domain, DKIM checks the message's signature, and DMARC checks that one of them matches the From domain.
Is it safe to paste email headers here?
Yes. The analysis runs in your browser and the headers are not sent to our server. Headers can contain your email address and internal server names, so avoid pasting them into tools that upload them.