Email header analyzer
Paste the raw headers of an email (in Gmail: "Show original"; in Outlook: Message Options). Received headers are listed top-to-bottom as they appear — the topmost is the most recent hop, closest to you.
From
Bob <bob@senderdomain.com>
To
Alice <alice@example.com>
Subject
Quarterly report
Date
Wed, 27 Aug 2026 09:59:50 +0000
Message-ID
<abc123@senderdomain.com>
Return-Path
—
SPF
pass
DKIM
pass
DMARC
pass
Hop 1
by 2002:a05:6a00:abcd::1 with SMTP id xyz; Wed, 27 Aug 2026 03:00:00 -0700 (PDT)
Hop 2
from mail-relay.example.net (mail-relay.example.net. [203.0.113.5]) by mx.google.com with ESMTPS id abc123; Wed, 27 Aug 2026 02:59:58 -0700 (PDT)
What is Email header analyzer?
Every email carries hidden "Received" headers recording each mail server it passed through on its way to your inbox, plus authentication results — together they're how you trace an email's real path and spot signs of spoofing.
How to use it
Paste an email's raw headers (in Gmail: "Show original"; in Outlook: Message Options) to see From/To/Subject, SPF/DKIM/DMARC results, and every delivery hop in order.
Example
A legitimate email typically shows: SPF: pass, DKIM: pass, DMARC: pass,
with 2-4 Received hops between sender and inbox.