Free Email Header Analyzer
Inspect email headers locally. Read reported SPF, DKIM and DMARC results, signing details and mail hops without uploading your message.
How the interpretation works
Standard folded header lines are unfolded. Common encoded words are decoded for the message overview; unsupported encodings remain visible. Authentication fields are parsed into their reported methods, results and details. Received headers are reversed to show oldest first.
See RFC 8601 on authentication-result trust, RFC 5322 on message headers, and RFC 2047 on encoded words.
How to use email header analyzer
Copy the original headers from your email app or choose a small .eml/.txt file.
Analyze the headers, then identify the authentication field added by your receiving provider. Review other fields as untrusted claims.
Inspect the From, Reply-To, signing domains and Received hops. Use the original message and your provider’s tools to investigate anything unexpected.
Privacy and scope
Headers often contain email addresses, server IPs and message identifiers. This tool processes them locally and displays header claims without validating their origin. It is not a phishing verdict, a live network trace, an SPF evaluator or a DKIM verifier.
The tool does not save inputs in browser storage. Reset or leave the page to clear its in-page state. Downloads and clipboard copies remain wherever you save or paste them.
Frequently asked questions
Where do I find the original email headers?
In Gmail, open the message menu and choose Show original. In Outlook, look for View message details, View source, or Internet headers; the wording varies by app. Copy the original headers, not a screenshot or the visible message text. Small .eml and .txt files are accepted locally.
Does a reported DMARC or DKIM pass prove the message is safe?
No. Authentication-Results fields are claims made by a server and can be forged or copied. Only rely on fields added within your receiving provider’s trusted infrastructure. Even a genuine authentication pass does not make links, attachments or the sender’s intentions safe. This tool does not independently authenticate messages.
Can this tool verify a DKIM signature?
No. It displays the signing domain, selector and algorithm from supplied DKIM-Signature fields. Cryptographic verification requires the original message bytes and the signing domain’s DNS key. A signature being present is not evidence that it is valid.
Why are some mail-hop times negative or unavailable?
Received fields are listed oldest first by reversing their header order. Gaps are differences between adjacent parseable timestamps, not measured network latency. Server clock differences and incomplete or altered headers can produce negative gaps. Dates without an explicit timezone are left unavailable.
Are my message or header details uploaded?
No. Parsing and file reading happen in this browser. The analyzer makes no DNS requests and does not open message links or inspect attachments. Text after the first blank line is excluded from the analysis. Input size is limited to 256 KiB, including any pasted body or loaded file.