Email Header Analyzer
Every email carries hidden headers that record where it came from and whether it passed security checks. Paste them here to see the route it took, how long each step took, the server that really sent it, and whether it’s genuine.
Everything is read in your browser. The headers aren’t sent anywhere.
- Gmail: open the message, click the three dots next to Reply, and choose Show original. Click Copy to clipboard.
- Outlook (web): open the message, click the three dots, then View → View message source.
- Outlook (Windows): open the message in its own window, then File → Properties, and copy the Internet headers box.
- Apple Mail: open the message, then View → Message → Raw Source.
- Yahoo Mail: open the message, click the three dots, and choose View raw message.
You can also save the message as an .eml file and open it here.
SPF checks that the sending server is allowed to send for the domain. DKIM checks a digital signature, proving the message wasn’t changed and showing which domain signed it. DMARC ties them together: it passes only when SPF or DKIM succeed for the same domain shown in the From line, which is what stops strangers from sending mail that looks like it’s from your bank.
The route is read from the “Received” lines, which each server adds as the message passes through. The ones added by your own mail provider can be trusted; anything below the point where the message entered their system was written by the sender and could be faked.
