Email Header Analyzer
Paste raw email headers to trace routing, check authentication, and detect delays. 100% client-side.
What are Email Headers?
Email headers contain the technical details of a message's journey from sender to recipient. They include routing information (Received headers), authentication results (SPF, DKIM, DMARC), and metadata like Message-ID and return path. Analyzing headers helps diagnose delivery issues, detect spoofing, and understand email infrastructure.
How to find email headers
- Gmail: Open email → ⋮ menu → Show original
- Outlook: Open email → File → Properties → Internet headers
- Yahoo: Open email → ⋮ menu → View raw message
- Apple Mail: Open email → View menu → Message → All Headers
- Thunderbird: Open email → View → Headers → All
What do SPF, DKIM, and DMARC mean?
- SPF (Sender Policy Framework) — validates that the sending server is authorized to send email for the domain. A "Pass" means the server is listed in the domain's DNS records.
- DKIM (DomainKeys Identified Mail) — a cryptographic signature that proves the email was not modified in transit. "Pass" confirms the message is authentic.
- DMARC (Domain-based Message Authentication) — a policy layer on top of SPF and DKIM that tells receiving servers what to do when authentication fails (reject, quarantine, or none).
Common email delivery issues to diagnose
- Email landing in spam — check SPF/DKIM/DMARC results; a fail on any of these significantly increases spam classification risk
- Delayed delivery — compare timestamps on consecutive Received headers to identify which server introduced a delay
- Phishing or spoofing — check whether the From address domain matches the Return-Path and DKIM signature domain
- Missing authentication — if SPF or DKIM is absent, your sending domain may not have those DNS records configured
Privacy note
Email headers are parsed entirely in your browser. No header data is sent to any server — your email information stays private.
Frequently Asked Questions
How do I find email headers in Gmail?
Open the email in Gmail, click the three-dot menu (⋮) in the top-right of the message, and select "Show original". The raw headers will open in a new tab — copy everything in the box and paste it into this tool.
What does SPF pass or fail mean?
SPF (Sender Policy Framework) checks whether the server that sent the email is listed in the domain's DNS as an authorised sender. A fail means the sending server is not authorised, which strongly suggests spoofing or misconfigured email infrastructure.
Why is my email going to spam?
Emails land in spam due to SPF, DKIM, or DMARC failures, sending from a blacklisted IP, missing authentication DNS records, suspicious content patterns, or low sender reputation. Analysing the headers shows which checks failed and where the issue originates.
How do I trace an email delay using headers?
Read the Received headers from bottom to top — each one shows which server handled the message and when. Compare timestamps between consecutive hops: a large gap pinpoints exactly which server or relay caused the delay.