Email Header Analyzer
This free email header analyzer reads raw email headers in your browser and shows the delivery path, the delay between servers, and whether SPF, DKIM and DMARC passed.
Your headers never leave your browser: they're analyzed on this page and nothing is uploaded or stored.
What do email headers tell you?
Email headers are the delivery record of a message: every server it passed through, when it got there, and what the receiving server concluded about SPF, DKIM and DMARC.
Mail apps hide them by default. In Gmail, open the message, click the three dots and choose Show original. In Outlook on the web, open the message menu and choose View, then View message source; in Outlook for Windows, use File, then Properties. In Apple Mail, choose View, Message, All Headers.
How to read the results
The delivery path is listed oldest first. A gap of more than a minute between two servers usually means a mail queue, greylisting or a slow spam filter, and we highlight those hops.
Authentication results show the receiving server's verdict. A DMARC fail next to a familiar brand name in the From line is the strongest sign of spoofing, and a Reply-To that points somewhere else is another common phishing pattern.
Your headers stay in your browser
Nothing is uploaded: this tool analyzes the headers with JavaScript on this page, and nothing is sent to our servers or stored. That matters, because headers contain email addresses, server names and sometimes internal IP addresses.
You can check this yourself: load the page, disconnect from the internet, and the analyzer still works.
Frequently asked questions
How do I find the full headers of an email?
Look for Show original (Gmail), View message source (Outlook on the web), File > Properties (Outlook for Windows) or View > Message > All Headers (Apple Mail). Copy everything above the message text and paste it here.
Why did an email take so long to arrive?
Look for the hop with the longest delay. Greylisting deliberately holds mail from first-time senders for a few minutes, busy spam filters queue messages, and a sending server that retries after a failure adds its retry interval.
What does dmarc=fail mean in the headers?
The From domain wasn't backed by an aligned SPF or DKIM pass. Either someone is spoofing that domain, or the real sender hasn't set up SPF and DKIM for the service it used.
Is it safe to paste my headers here?
Yes. The analysis runs entirely in your browser, and the headers are never uploaded or stored. Still, avoid sharing raw headers publicly, since they contain addresses.
Why are the times in different time zones?
Each server stamps the time in its own time zone. We convert them all to the same clock to work out the delay between hops.