Email Header Analyzer
Paste an email’s headers to see if it’s really from its sender, why SPF, DKIM or DMARC failed, and where it was delayed.
Runs in your browser. Nothing you enter is uploaded.
Where to find the headers
- Gmail
- Open the message, click ⋮ (More), then Show original, then Copy to clipboard.
- Outlook (new, and on the web)
- Open the message, click … (More actions), then View, then View message details.
- Outlook (classic, Windows)
- Open the message in its own window, click File, then Properties, and copy the Internet headers box.
- Apple Mail
- Select the message, then View > Message > Raw Source.
- Yahoo Mail
- Open the message, click … (More), then View raw message.
- Thunderbird
- Select the message, then View > Message Source.
- Phones
- Mail apps on phones don’t show headers. Open your mail’s website in a browser, or use a computer.
Paste an email's headers to check them
See whether it really comes from its sender, its SPF, DKIM and DMARC results, and every server it passed through. Nothing you paste leaves your device.
How to use Email Header Analyzer
- Open the email and copy its full headers. Where to find the headers, under the box, has the steps for Gmail, Outlook, Apple Mail and others.
- Paste them into the box. The analysis appears right away.
- Read the verdict and the SPF, DKIM and DMARC results. Each warning says what it means.
- Follow the delivery path to see every server the message passed through and where it waited.
- Copy the report to send to your IT team or email provider.
How it works
Every email carries headers: lines added by the sender’s app and by each server the message passed through. The analyzer reads them in your browser. Nothing you paste is uploaded, and nothing is looked up online.
| Header | What it tells you |
|---|---|
| Authentication-Results | The SPF, DKIM and DMARC results your own mail server worked out when the message arrived |
| Received | One line per server, newest at the top: which server handed the message to which, and when |
| From, Reply-To | Who the message says it’s from, and where replies go |
| Return-Path | The bounce address, the domain SPF checks |
| DKIM-Signature | The domain that signed the message, and its selector |
Only the topmost Authentication-Results line counts. Your mail server added it; anything lower down could have been written by the sender, including fake results.
Reading the results
| Result | Means |
|---|---|
| SPF pass | The sending server is on the bounce domain’s list of allowed senders |
| SPF softfail or fail | It isn’t. Softfail (~all) is accepted with suspicion, fail (-all) is refused by strict receivers |
| DKIM pass | The domain in d= signed the message, and the signed parts weren’t changed |
| DKIM fail | The message changed after signing, or the key doesn’t match |
| DMARC pass | SPF or DKIM passed for the domain in the From address itself |
| DMARC fail | Neither did. The From address may be fake |
SPF and DKIM can pass for another domain, like a newsletter service’s bounce domain, while DMARC still fails. DMARC is what ties a message to the address you see.
Signs of a spoofed or phishing email
- DMARC failed for a well-known domain, like your bank or a delivery company.
- The display name shows a different address, like
"security@yourbank.com" <alerts@other-domain.net>. - Replies go elsewhere: a Reply-To at a different domain than the sender’s.
- A lookalike domain that passes everything: yourbank-secure.com passes DMARC for yourbank-secure.com. Check that the domain is the one you expect.
Delays
Each Received line has a time, so the gap between two lines is how long the message waited. A wait of minutes or hours usually means greylisting (the receiving server asks unknown senders to try again later), a busy spam filter, or the sending server retrying after a failure. Times of a few seconds out of order mean two servers’ clocks disagree, not a problem with the message.
Questions
How can I tell if an email is spoofed from the header?
Look at the Authentication-Results line your own mail server added. dmarc=fail means neither SPF nor DKIM proved the From domain sent it, which is the clearest sign. Other signs: a display name that shows a different address, a Reply-To at another domain, and spf=fail or softfail.
Can you find the sender’s IP address from an email header?
You can find the IP of the server that sent the message: it’s in the topmost Received line from outside your provider, and in the SPF result. Gmail, Outlook.com and most providers don’t include the IP of the sender’s own computer or phone, and an IP only points to a provider, not a person.
What does SPF softfail mean?
The server that sent the message isn’t on the domain’s list of allowed senders, but the domain’s SPF record ends in ~all, so receivers accept the message and count it against it. It often means the domain owner forgot to add a service, or the message was forwarded.
Why does DKIM fail?
The signature no longer matches the message. Something changed it after it was sent: a forwarding rule, a mailing list adding a footer or a security scanner rewriting links. It also fails when the sender’s key in DNS was changed or removed.
Is it safe to share email headers?
Mostly. Headers don’t contain the message body or attachments, but they do show your email address, the sender’s, the subject and the servers’ IP addresses. This analyzer runs in your browser, so nothing you paste is uploaded.
Related tools
Updated October 20, 2026 · Works in current Chrome, Edge, Firefox and Safari · Runs entirely in your browser