Email Header Analyzer

Parses a raw email header block and traces the full path a message took — every mail server hop, timestamps, and the authentication results (SPF, DKIM, DMARC) as evaluated by the receiving server. This is the tool for investigating a suspected phishing or spoofing attempt, since the visible From address in an email client is trivially fakeable, but the header trail underneath shows the actual originating server. To use it, copy the full raw header block from your mail client — the visible fields in a normal inbox view aren't enough.

Received headers are stacked in reverse order — the actual originating server is the bottom-most Received line, not the top, which is a common source of confusion when tracing the hop path by eye.

📖 Read more in our Knowledge Base →