Security

Email Header Analyzer

Trace mail delivery hops, detect spoofing, and extract SPF/DKIM/DMARC results from raw email headers.

Delivery Hops

About Email Header Analyzer

Parses a raw email header block and traces the full path a message took — every mail server hop, timestamps, and the authentication results (SPF, DKIM, DMARC) as evaluated by the receiving server. This is the tool for investigating a suspected phishing or spoofing attempt, since the visible From address in an email client is trivially fakeable, but the header trail underneath shows the actual originating server. To use it, copy the full raw header block from your mail client — the visible fields in a normal inbox view aren't enough.

Received headers are stacked in reverse order — the actual originating server is the bottom-most Received line, not the top, which is a common source of confusion when tracing the hop path by eye.

📖 Read more in our Knowledge Base →

How to get headers

Gmail: Open email, 3-dot menu, "Show original"
Outlook: File > Properties > Internet headers
Apple Mail: View > Message > All Headers
Thunderbird: View > Headers > All

Related Tools

How to get the full email header

The analyzer needs the raw header block, not the visible From/To/Subject lines. Every mail client hides it in a different place:

Gmail (web): open the message → ⋮ menu → Show original → copy everything above the message body.
Outlook (desktop): open the message → File → Properties → copy the Internet headers box. Outlook on the web / new Outlook: ⋯ → View → View message source.
Apple Mail: View → Message → All Headers (or Raw Source).
Thunderbird: View → Message Source (Ctrl+U / ⌘U).

Paste the whole block. Trimming lines — especially the lower Received: entries — removes exactly the evidence you usually need.

How to read the results

Received hops. Each server that handled the message adds a Received: line at the top, so the chain reads bottom-up: the lowest line is the origin, the top line is your own mail server. Large gaps between consecutive timestamps show where a message was queued or delayed. Small differences, or times that appear to run backwards, are usually clock skew or time-zone formatting rather than a real problem.

Authentication-Results. Written by the receiving server, this is the verdict that actually mattered for delivery:

spf=pass — the sending IP is authorized by the SPF record of the envelope sender (Return-Path) domain.
dkim=pass header.d=example.com — the message carries a valid signature from that domain and was not modified in transit.
dmarc=pass — SPF or DKIM passed and the passing domain aligns with the visible From domain.

Forwarded or mailing-list mail often fails SPF while DKIM still passes; ARC- headers record the authentication state from earlier hops in that case.

Signs of spoofing or phishing

The visible From: domain differs from the Return-Path and from the DKIM d= domain, and DMARC fails.
A Reply-To: pointing to an unrelated address or free-mail provider.
The first external Received: hop comes from an IP or hostname with no relation to the claimed sender — check it with a reverse DNS lookup or IP reputation check.
spf=softfail or dkim=none on a message claiming to be from a large organization that normally signs its mail.

If your own messages fail these checks, review the sending domain with the SPF, DKIM & DMARC checker.