Email Header Analyzer - Trace the Sender, Hops & Authentication Results
A suspicious email is sitting in your inbox and the “From” name tells you nothing — that field is the easiest thing in an email to fake. The full story is in the headers. Paste them below to trace the message back through every server it passed, see the originating IP address, and read the SPF, DKIM, DMARC, and CompAuth verdicts the receiving servers recorded. Built for anyone investigating phishing, diagnosing delivery delays, or doing email forensics — free, with no signup.
How to Use the Email Header Analyzer
- Get the full header from your email client.In Gmail, open the message, click the three-dot menu, and choose “Show original.” In Outlook, open the message and go to File → Properties, then copy the “Internet headers” box. In Yahoo Mail, use “View raw message” from the More menu.
- Paste the header into the box above— or use “Upload File” to load a saved message, or “Load Sample Header” to see how a parsed result looks first.
- Click “Analyze Header.”The parser breaks the raw text into an authentication results table, a hop-by-hop delivery path, and every header grouped by category.
Not sure what you’re looking at yet? The sections below explain what each part of the result means.
What the Analyzer Shows You
Authentication results.The tool reads the Authentication-Results and Received-SPF headers and shows you whether the message passed or failed SPF, DKIM, and DMARC when the receiving server evaluated it. For mail that passed through Microsoft 365, it also surfaces the CompAuth verdict — Microsoft's composite authentication result that most email header analysis tools skip. ARC headers (ARC-Seal, ARC-Message-Signature, ARC-Authentication-Results) are parsed too, so you can follow authentication across forwarders and mailing lists.
The delivery path, hop by hop. Every mail server that handles a message stamps a Received header on top of the stack. The analyzer reads them bottom-to-top and lays out the full route as a table: which server handed the message to which, over what protocol, at what time, and how long each hop took. Long delays concentrated at one hop point you straight at the server causing a delivery problem. The earliest entries in the chain carry the originating IP address — the closest thing an email gives you to a return address.
Every header, organized. Instead of a wall of raw text, headers are grouped into security headers, routing headers, X-headers, and everything else — so Return-Path, Reply-To, Message-ID, and Delivered-To are exactly where you expect them.
What is an Email Header?
Every email has two parts: the body you read, and a block of metadata called the header that travels with it. Your email client shows you a few friendly lines from it — From, To, Subject, Date — but the full header records far more: the message’s unique ID, the address that actually receives replies, the digital signatures added by the sending domain, and a Received entry from every server the message passed through on its way to you.
Most of that is invisible in day-to-day use, and that is exactly why it is useful. The visible “From” field can be forged trivially; the Received chain and authentication signatures are recorded by servers the sender does not control. Reading email headers is how mail administrators debug delivery, and how security teams decide whether a message is genuine.
How to Spot a Phishing Email from Its Headers
Start with the authentication verdicts. A message claiming to be from your bank that fails SPF and DKIM, or carries a DMARC “fail,” was not sent by the infrastructure that domain authorizes. That single check catches a large share of spoofed mail.
Then compare the Return-Path and Reply-To against the From address. Legitimate senders usually match; phishing emails often display a trusted name in From while routing replies somewhere else entirely.
Finally, trace the source. The earliest Received entries show the IP address the message actually originated from. If a message claims to come from a US company but the originating IP sits in a network with no relation to it, you have your answer. Run the source IP through the IP Threat Intelligence API to check whether it is a known proxy, VPN exit, or flagged attacker, or look up its location and network owner with the IP Geolocation API.