Email Header Analyzer
Paste raw email headers to see the delivery path hop by hop, where delays happen, and whether SPF, DKIM and DMARC passed and aligned. Runs offline in your browser.
Your headers are parsed in this browser tab. Nothing is uploaded and no DNS query is made. Because the headers stay in your browser and nothing is uploaded, there is no shareable link for this tool; the address bar never contains your message.
What this checks
Paste the full raw headers of a message and the tool unfolds them (RFC 5322 §2.2), decodes encoded subjects and names (RFC 2047) and lists every Received field in the order the message travelled. Each relay prepends one Received field (RFC 5321 §4.4), so the bottom-most one is the origin; the table reverses them so hop 1 is where the mail started, and the delay column is the difference between consecutive timestamps.
Authentication results are read from the Authentication-Results header (RFC 8601). Only the top-most header is trusted, because the receiving server must delete forged copies and adds its own on top (RFC 8601 §5); lower ones are shown as untrusted. The tool does not verify DKIM signatures or evaluate SPF itself, since that needs DNS and the original message body. It reports what your receiver decided.
DMARC passes only if SPF or DKIM passed and the passing domain aligns with the visible From domain (RFC 9989 §4.10.2). Relaxed alignment accepts any domain with the same organizational domain, strict requires an exact match. The tool recomputes this from the trusted result, which is the most common reason mail from a newsletter service passes SPF and DKIM yet still fails DMARC.
ARC headers (RFC 8617) record the authentication results seen by intermediaries such as mailing lists and forwarders, with cv= showing whether the chain was intact. They help explain why a forwarded message failed SPF but was still accepted. Delays above 60 seconds, negative delays (clock skew between servers) and truncated pastes are flagged as warnings.
If it fails
- DMARC alignment fails: make your sending service sign with your own domain (custom DKIM, d= equal to your From domain) or use a custom bounce domain for SPF. See the alignment guide.
- SPF fails or softfails: the connecting IP is not listed in the SPF record of the Return-Path domain. Add the sender's include mechanism and check the lookup count.
- No Authentication-Results: you probably pasted the sender's copy from the Sent folder. Open the message in the recipient's mailbox and copy its headers.
- Large delay at one hop: look at the relay named in the by column, it is usually greylisting, a queue or a scanning appliance.
FAQ
Is it safe to paste my email headers here?
Yes. The text is parsed by JavaScript in your browser tab. Nothing is uploaded, no DNS query is made and the address bar never contains your headers, so there is also no shareable link. Headers still contain addresses and IPs, so redact them before sharing screenshots.
How do I get the full headers of an email?
Gmail: open the message, menu, Show original. Outlook: File, Properties, Internet headers. Apple Mail: View, Message, All Headers. Copy everything above the first blank line.
Why is the Received order reversed?
Every server adds its Received line on top, so the file lists newest first. The table shows oldest first so you can read the journey in order and the delay column makes sense.
SPF and DKIM pass but DMARC fails. Why?
DMARC needs alignment: the domain that passed must match the From domain (same organizational domain for relaxed mode). A newsletter tool that signs with its own domain passes DKIM but is not aligned with yours.