FreeNo account, nothing sent anywhere

Analyze email headers in plain English.

Paste the headers of any email to see who really sent it, whether it passed SPF, DKIM and DMARC, and how long each server took to deliver it.

Nothing uploadedSPF, DKIM, DMARCEvery delivery hop
Paste the email headersor drop a saved .eml file on the box
Where do I find them?
Nothing leaves this page
How to analyze email headers

Copy, paste, read.

1

Copy the headers

In your mail app, open the email and show its original or its headers (the steps for each app are below). Copy everything.

2

Paste them here

Paste into the box above, or drop a saved .eml file on it. Copying the whole message is fine: the body is ignored.

3

Read the verdict

See whether the sender passed its checks, what looks wrong, and how the email travelled from server to server.

Where are the headers?

How to see the full headers in each mail app.

Gmail

  1. Open the email.
  2. Click the three dots next to Reply.
  3. Choose Show original.
  4. Click Copy to clipboard and paste it here.

Outlook for Windows

  1. Double-click the email to open it in its own window.
  2. Choose File › Properties.
  3. Click in the Internet headers box, press Ctrl+A, then Ctrl+C.
  4. Paste it here.

New Outlook and Outlook.com

  1. Open the email.
  2. Click the three dots (More actions) at the top of the message.
  3. Choose View › View message details.
  4. Select all the text, copy it and paste it here.

Apple Mail

  1. Open the email.
  2. Choose View › Message › Raw Source (Option+Command+U).
  3. Press Command+A, then Command+C.
  4. Paste it here.

Yahoo Mail

  1. Open the email.
  2. Click the three dots (More) in the toolbar.
  3. Choose View raw message.
  4. Select all, copy and paste it here.

Thunderbird

  1. Open the email.
  2. Choose More › View Source (Ctrl+U).
  3. Press Ctrl+A, then Ctrl+C.
  4. Paste it here.
What are email headers?

The postmarks every email collects on its way to you.

Every email carries a block of headers above the message you read. Some are written by the sender's app: From, To, Subject, Date. Most are added along the way: each mail server that handles the message stamps a Received line on top, with its name, the server it came from and the time. Read from the bottom up, those lines are the email's route, and the gaps between their times show where it waited.

The receiving server also records whether the email passed three checks. SPF asks whether the sending server is allowed to send for the domain. DKIM checks a signature the sending domain put on the message, which breaks if the message was altered. DMARC ties both to the address in the From line and says what the domain wants done with failures. An email that fails DMARC did not come from the domain it claims.

The From line itself is just text the sender typed, which is why phishing emails can show a bank's name. This analyzer compares it with the checks, the Reply-To and the Return-Path, and points out what does not match. To check a domain's own setup rather than one email, use the SPF, DKIM and DMARC checker. To read the message itself, use the EML Viewer or, for Outlook files, the MSG Viewer.

Private by design

Your headers stay on this page.

Headers contain email addresses, server names and IP addresses, so the analyzer never sends them anywhere. It is a script running in this browser tab: nothing you paste is uploaded, logged or stored, and it works with Wi-Fi switched off.

SPF, DKIM and DMARC results
Every server on the delivery path
The delay at each hop
Reply-To and Return-Path mismatches
Fake sender names hiding another address
Spam scores from Microsoft 365 and SpamAssassin
Whether links or attachments are safe
Where in the world the sender is
FAQ

Email Header Analyzer questions.

What is an email header analyzer?

It reads the technical headers of an email and explains them: who sent it, which servers it passed through, how long each step took, and whether it passed the SPF, DKIM and DMARC checks that show the sender is genuine.

How can I tell if an email is fake?

Paste its headers here. If DMARC failed, or SPF and DKIM both failed, the email did not come from the domain in its From line. Also be careful when the Reply-To goes to a different domain, or when the sender's name contains an email address that is not the real sender.

What do SPF, DKIM and DMARC mean?

SPF lists the servers allowed to send email for a domain. DKIM is a signature the domain adds to each email, so changes can be detected. DMARC checks that SPF or DKIM passed for the same domain as the From address and tells receivers what to do when they do not.

Why was an email delayed?

The delivery path shows the time each server received the email. A large gap between two hops shows where it waited, usually in a spam filter, a busy queue or a server that retried after an error. Clocks on servers can differ by a few seconds, so small negative gaps are normal.

Can I find out where the sender is?

The headers show the IP address of the server that sent the email. For Gmail, Outlook.com and most companies that is the provider's server, not the person's computer, so it rarely reveals a location. The analyzer shows the address but does not look it up.

Is it safe to paste email headers here?

Yes. The analysis runs in your browser and nothing you paste is sent to a server. Headers do contain email addresses and IP addresses, so be careful pasting them into tools that upload them.

How do I see headers on an iPhone or Android phone?

The Gmail, Outlook and Apple Mail phone apps do not show full headers. Open the email in a web browser on a computer (Gmail's Show original, Outlook.com's View message details), or forward it as an attachment and open that.

Next steps

More free mail tools

SPF, DKIM and DMARC Checker

Check the sender domain's records.

DomainReport

EML Viewer

Open a saved .eml email with its attachments.

ViewEML

MSG Viewer

Open an Outlook .msg email without Outlook.

ViewMSG