Email Header Analyser
Paste the full headers of an email to see the route it took, how long each hop took, where it really came from, and whether SPF, DKIM and DMARC passed. Useful for spotting phishing and spoofed senders.
Last updated
🔒 What you type here never leaves this device. It all happens in your browser, which is told to block this page from sending anything to other websites. Try it with airplane mode on: it still works. Check for yourself
Sent to other websites from this page: 0
Gmail: open the message, ⋮ → Show original. Outlook: open the message, ⋯ → View → View message source (or Properties → Internet headers in the desktop app). Apple Mail: View → Message → All Headers.
How to analyse email headers
- Copy the full headers of the email (see below for where to find them).
- Paste them in, or click Try an example.
- Read the route, the delay at each hop, the real sending server and the SPF, DKIM and DMARC results.
Reading email headers
Every mail server that handles a message adds a Received line to the top of its headers, so reading them from the bottom up gives the route from the sender to you. The first hop outside the sender's own network usually shows the sending server's real IP address. Gaps of minutes between hops point to queuing or greylisting; a hop that seems to arrive before the previous one left means a server's clock is wrong. Only the hops added by your own provider can be fully trusted; anything below them could have been written by the sender.
SPF checks that the sending server is allowed to send for the envelope sender's domain. DKIM checks a cryptographic signature added by the sending domain. DMARC checks that one of them passed for the same domain shown in the From line, which is what stops simple spoofing. Your provider records the results in Authentication-Results. A Reply-To pointing somewhere other than the sender, or a display name containing a different email address, are classic phishing signs. A Return-Path on another domain is common for newsletters and mailing services and isn't suspicious by itself.
The headers are analysed in your browser and never sent anywhere. IP lookup links go to ipinfo.io only if you click them.
Questions about email headers
How do I see an email’s full headers?
In Gmail, open the email, click the three dots and choose Show original. In Outlook, open the message and choose View → View message source (or File → Properties in the desktop app).
How can I tell if an email is spoofed?
Check whether SPF, DKIM and DMARC passed for the sender’s domain, and whether the From address matches the domain that actually sent it. The analyser flags mismatches.
Can I find the sender’s IP address?
Usually the sending server’s, from the first hop outside their network. Webmail services often hide the user’s own IP.
Why read the Received lines from the bottom?
Each server adds its line to the top, so the bottom one is the earliest. Only lines added by your own provider can be fully trusted.