✉️ Email Header Analyzer
The Email Header Analyzer tool helps you read the hidden metadata at the top of an email — the “full headers” that show the real path a message took and whether it passed authentication checks.
What it does
The Email Header Analyzer tool helps you read the hidden metadata at the top of an email — the “full headers” that show the real path a message took and whether it passed authentication checks.
How to use it
Copy the full headers from your mail client (usually under “Show original” or “View source”) and paste them into the analyzer. It parses the Received chain and the Authentication-Results line showing SPF, DKIM and DMARC verdicts.
Real-world example
If a colleague says they never got your message, analyze the headers to see the Received hops and the final status or spam annotation. A failed DKIM or DMARC result explains why a provider quarantined it, and the Received chain shows exactly which server delayed or rejected it.
Frequently Asked Questions
Where do I find an email's full headers?
In most clients: open the message, choose “Show original” (Gmail), “View source” (Outlook), or “Raw source” (Thunderbird). That reveals the headers above the message body.
What do SPF, DKIM and DMARC mean?
They are email-authentication standards. SPF lists authorized sending IPs, DKIM proves the message wasn't tampered with via a signature, and DMARC tells receivers how to handle failures. “pass” on all three is the healthy state.
Can headers prove a phishing email's true sender?
They help. The Received chain records the servers the mail traversed, and authentication results reveal spoofing. But headers can be partly forged by the first hop, so treat the earliest Received line with caution.