Paste raw email headers to extract and analyse routing path, authentication results (SPF, DKIM, DMARC), delivery delays, and sender info.
Paste the full raw email headers below (Gmail: ⋮ → Show original → Copy to clipboard)
📨 Email Header Analyzer
Every email carries a set of headers — metadata added by each mail server the message passes through. Analyzing these headers reveals the true origin of an email, the path it took, authentication results, and whether it was delayed or tampered with.
📍 Received Headers
Each mail server adds a Received: header. Reading them from bottom to top traces the email's path from origin to your inbox, including timestamps and server IPs.
🛡️ Authentication Results
The Authentication-Results header shows SPF, DKIM, and DMARC pass/fail status as assessed by your incoming mail server.
🕵️ Origin IP
The lowest Received: header (the first one added) shows the IP address of the originating mail server — useful for tracing spam or phishing to its source.
⏱️ Delivery Delays
Comparing timestamps between consecutive Received: headers identifies which hop in the chain caused delays in email delivery.
🔍 How to Get Email Headers
- Gmail: Open email → three-dot menu → "Show original"
- Outlook: Open email → File → Properties → Internet headers
- Apple Mail: View menu → Message → All Headers
- Thunderbird: View → Headers → All
❓ Frequently Asked Questions
Can email headers be faked?
Yes — any header above the first "trusted" Received: header (added by your own mail server) can be forged by the sender. Always trust only headers added by your own infrastructure.
What is X-Originating-IP?
A non-standard header added by some webmail providers showing the IP address of the user's browser when they composed the message. Not present in all emails.