Free tool · email header analysis
Paste a message’s full headers for one plain answer — is this email really from who it says? — plus SPF, DKIM and DMARC, every server it went through, and where it was delayed.
Is this email real?
Header report
Verdicts recorded by , the server that received the message.
Total:
received from
·
Every email carries a block of headers above the text you read. Most apps hide it, but all of them can show it. Copy the whole header block — the analyzer ignores the message body if you paste that too.
| App | Where the headers are |
|---|---|
| Gmail (web) | Open the message, click More (⋮) next to Reply, choose Show original, then Copy to clipboard. |
| New Outlook for Windows and Outlook on the web | Open the message, select More actions (…), then View → View message details. |
| Classic Outlook for Windows | Open the message in its own window, choose File → Properties, and copy the Internet headers box. |
| Apple Mail on Mac | Open the message and choose View → Message → All Headers. |
| iCloud Mail (iCloud.com) | Select the message, click More, then Show All Headers. |
| Yahoo Mail | Open the message, click More (…), then View Raw Message. |
| AOL Mail | Open the message and choose View Message Source from the Action menu. |
| Thunderbird | Open the message and choose View → Message Source. |
If your phone app has no option to show headers, open the same message in your provider’s website on a computer instead.
These verdicts come from the Authentication-Results header that the receiving mail server added when the message arrived. We read only the top-most one: it was written by your provider, while lower ones could have been added by anyone along the way.
A DMARC fail on a message claiming to be from your bank, your boss or a delivery company is a strong warning sign. Forwarded mail and some mailing lists can fail too, so weigh it alongside the other findings.
Each server that handles a message adds a Received line at the top, so the oldest is at the bottom. The analyzer turns them around and shows them oldest first, with the time between each step. A large gap shows where a message was held up — usually a busy server, a retry or a spam check. Small negative gaps just mean two servers’ clocks disagree.
If a message fails these checks and asks for money, passwords or personal details, don’t reply or click its links. Report it as phishing in your email app.
Yes. The analysis runs in your browser and the headers are never sent to our server. Headers do contain email addresses and server names, so on a shared computer, clear the box when you’re done.
Lines at the top of every message that record who sent it, who it’s for, the servers it passed through and the results of SPF, DKIM and DMARC checks. Email apps hide most of them by default.
Look at the oldest Received line — the first step in the route — and at the DMARC result. If DMARC passes, the From domain is genuine. If it fails, the From address can’t be trusted.
SPF checks the envelope (bounce) domain, which can be different from the From address. DMARC requires SPF or DKIM to pass for the From domain itself, so a message can pass SPF for one domain while falsely claiming to be from another.
Some apps and mail servers don’t add or show it. Open the message in your provider’s webmail and copy the headers from there.
Check the route: the step with the biggest gap is where it waited. A delay before your provider’s server usually happened at the sender’s side; a delay after it, at the receiving side.
More free tools
Guides