Email Header Analyzer
Paste the raw headers of a received email (Received:, Authentication-Results:, etc.) to see the delivery path broken down hop by hop, along with SPF/DKIM/DMARC results. Parsing runs 100% in your browser.
What each Received: clause means
| Clause | Meaning |
|---|---|
| from | The hostname/IP address of the server that handed off this message. This can be spoofed, so the oldest (bottom) hop is the most trustworthy source for the actual originating IP. |
| by | The hostname of the server that received the message at this hop (e.g. your own mail server). |
| with | The delivery protocol used (e.g. ESMTP, ESMTPS, SMTP). ESMTPS indicates the connection was encrypted with TLS. |
| for | The recipient address the message was delivered for. Often omitted for mailing lists or messages with multiple recipients. |
| timestamp | The date and time this hop received the message (with the sending server's local timezone). The gap between hops is a rough measure of delivery delay. |
What each Authentication-Results: field means
| Field | Meaning |
|---|---|
| SPF | SPF (Sender Policy Framework) result: whether the sending IP is listed among the addresses the domain's DNS record permits. |
| DKIM | DKIM (DomainKeys Identified Mail) result: whether the cryptographic signature over the message body and key headers verified against the sending domain's public key. |
| DMARC | DMARC (Domain-based Message Authentication, Reporting & Conformance) result: an overall verdict checking SPF/DKIM alignment against the domain in the From header. |
Tips
- In Gmail, open the message, click the three-dot menu in the top right, and choose "Show original" to get the raw headers. In Outlook, use File > Properties > Internet headers.
- Received: headers are prepended to the message in newest-first order (the receiving side comes first), so this tool reorders them chronologically from sender to receiver for you.
- If mail servers along the path have slightly unsynchronized clocks, the "delay since previous hop" can show a negative number. A small negative value usually just reflects clock drift, not an actual delivery problem.
- Even if SPF, DKIM, and DMARC all pass, that does not guarantee the message is not a scam. Authentication only verifies the domain owner's own setup was followed correctly — it cannot detect a malicious actor who legitimately owns a look-alike domain.
- If the delay jumps sharply between two particular hops, that segment of the path is where a delivery bottleneck or spam-filter hold likely occurred.
Frequently Asked Questions
Side Note — Email headers are a stack of digital postmarks
Just as a postmark on a letter records which post office handled it and when, the Received: headers on an email are a stack of "digital postmarks" — every server that relayed the message stamps its own timestamp onto it. The SMTP protocol (RFC 5321) requires every relaying server to prepend its own information to the top of the header block, so a complete record of the delivery path accumulates naturally with every message.
This turns out to be most useful for tracing the source of spam. Anyone can freely rewrite the From header, but as long as the sender used standard SMTP, the oldest Received hop — the one where the message was first injected into the mail system — records a connecting IP address that is genuinely difficult to forge. That oldest hop is exactly what spam investigators check first.
SPF, DKIM, and DMARC were added later to catch spoofing that postmarks alone cannot stop. SPF checks whether the sending IP is on the domain's permitted list, DKIM verifies a cryptographic signature to confirm the content was not altered, and DMARC combines both checks against the domain in the From header for an overall verdict. After Google and Yahoo effectively required DMARC for bulk senders in 2024, Authentication-Results headers became a routine sight in everyday inboxes.
Email headers are something most people never open, but the moment you do, you find a precise, invisible travel log — which servers around the world a single message passed through, and how many seconds it took at each step.