Email Header Analyzer: Free Online Checker

An email header analyzer reads the raw header text of a message and turns it into a readable report. Paste the headers into this free email header analyzer and you see who sent the message, which servers handled it, and what the SPF, DKIM and DMARC lines report. It suits anyone checking a suspicious or undelivered email.

What Is an Email Header?

An email header is the block of technical lines at the top of every message, added by your mail app and by each server that passes the message along. You normally never see it, because mail clients show only the sender, subject and body.

Each line has a name and a value, such as From, To, Subject, Date and Message-ID. Every server that handles the message also stamps a Received line on top of the pile, so the header becomes a timeline of the message's trip. Receiving systems may also add authentication results and spam scores.

Why headers matter

The visible "From" name is easy to fake. The header holds details that are much harder to disguise: the servers that relayed the message, the authentication verdicts and the real reply address. That is why security teams, mail administrators and cautious users read headers when something looks wrong.

How Do You Get Email Headers From Gmail and Outlook?

You copy them from the message's "original" or "properties" view, then paste them into the tool.

• Gmail: open the email, click More (the three dots), then choose Show original. Copy the header block at the top.
• Outlook desktop: open the message in its own window, then go to File and Properties. The internet headers appear in a box at the bottom.
• Outlook on the web: open the message, choose More actions (three dots), then View, then View message details.

Copy the whole block, from the first line to the last. A partial copy is the most common reason a report looks empty.

How to Use the Email Header Analyzer

1. Open the message you want to check and copy its full raw headers using the steps above.
2. Paste them into the Paste Email Headers box. The placeholder shows the expected layout: lines such as Received, From, To and Message-ID.
3. Click Analyze Headers.
4. Read the results table: From, To, Subject, Date, Message-ID, Reply-To, X-Mailer, SPF Result, DKIM Signature, DKIM Result, DMARC Result, Spam Score, Auth Results and Delivery Hops.
5. Scroll to the Delivery Path list, which shows each hop numbered in the order it appears in your pasted text.
6. Compare the fields against the checks in the sections below, then decide whether to trust, report or delete the message.

If you click the button with an empty box, the tool asks you to paste headers. If the text has none of the common header fields, it tells you no recognizable email header fields were found.

Worked Example: Checking a Suspicious "PayPal" Email

Say you receive a message claiming to be from payment support, and you paste its headers. The relevant lines include a display name of "PayPal Support" with an address at a lookalike domain, a different Reply-To address at a free mailbox domain, and an Authentication-Results line containing spf=fail, dkim=none and dmarc=fail. There are four Received lines.

The tool would show:

• From and Reply-To with two unrelated domains.
• SPF Result: FAIL (reported, unverified).
• DKIM Signature: Not found, and DKIM Result: NONE (reported, unverified).
• DMARC Result: FAIL (reported, unverified).
• Delivery Hops: 4 hop(s) detected.

Each sign alone could have an innocent cause, but together they point one way. The sender domain is not one the brand uses, replies would go to a third mailbox, and the receiving server reported failures on all three authentication checks. Treat this message as phishing: do not click links, and report it.

How Do You Read the Results?

Each row answers one question about the message. Here is what to look for.

SPF, DKIM and DMARC

SPF checks whether the sending server is allowed to send for the domain. DKIM checks a cryptographic signature added by the sending domain. DMARC ties them together by requiring that at least one aligns with the visible From domain, and tells receivers what to do if it does not.

The tool reads these verdicts from the Authentication-Results line, and falls back to the Received-SPF line for SPF when needed. Values are labeled "reported, unverified" because the tool displays what your mail provider wrote; it does not re-run the checks itself. The DKIM Signature row only tells you whether a signature line exists ("Present (not verified)") or not ("Not found"). To inspect a domain's published key, use a DKIM record checker with the selector from the signature.

Spam Score

This row shows the value of an X-Spam-Score or X-Spam-Status line, if your receiving system added one. Many filters based on SpamAssassin use a default threshold of 5.0, so a status such as "Yes, score=7.2 required=5.0" means the filter judged the message to be spam. If the row shows N/A, your provider simply did not add that header, which says nothing about the message itself.

Delivery Hops and Delivery Path

Every Received line is one hop. Because each server adds its line on top, the first hop listed is usually the most recent server and the last is closest to the original sender. Read the path from the bottom up to follow the message in time order. Look at the earliest hop: a message claiming to come from a major bank but first appearing from an unrelated host is a red flag. Each hop is shown shortened to its first 120 characters, so very long lines are cut off in the display.

How Do You Check Email Headers for Phishing or Spoofing?

Compare the claimed sender against the evidence, in this order:

1. Check that the From domain matches the organization the email claims to be.
2. Check that Reply-To, if present, uses the same domain. A mismatch is a common trick to redirect your answer.
3. Look at SPF, DKIM and DMARC. Three passes are reassuring; failures on a message that claims to be from a large brand are suspicious.
4. Inspect the earliest hop for an unexpected host or location.
5. Check the Message-ID domain. Legitimate mail often has an ID that matches the sending system, while forged mail may not.

No single field proves fraud. Mailing lists, forwarding and some legitimate services can break SPF or DKIM, so judge the whole pattern. If a hop shows a server IP you want to vet, a blacklist checker can tell you whether that address or domain appears on common email blocklists.

Who Uses an Email Header Analyzer?

• Everyday users who got a strange invoice, prize or password-reset message and want proof before clicking.
• IT and help desk staff triaging reports of phishing from employees.
• Email marketers and sysadmins debugging why campaign mail lands in spam, by confirming SPF, DKIM and DMARC verdicts at the receiving end.
• Developers testing that a new sending service stamps the right headers.
• Support teams investigating a "never received it" complaint by checking the timestamps across hops for a delay.

Best Practices and Troubleshooting

Paste the complete header

Copy everything from the first line through the blank line that separates headers from the body. Missing authentication lines produce "Not reported" or N/A entries that look like failures but are only gaps in your copy.

Use the original message, not a forward

If you forward a message as plain text, your mail client writes a new header and the original delivery history is lost. Use the Show original or Properties view on the received copy, or forward as an attachment.

Why do SPF or DKIM show Not reported or Not found?

Either the sending domain has not set them up, your provider does not write an Authentication-Results line, or the pasted text is incomplete. Try the same message in another mail client to compare.

Why does the page say no recognizable fields?

The text probably is not a header, for example only the message body. Look for lines that begin with names followed by a colon, and paste again.

Wrapped lines

Long header values often continue onto indented lines. The tool joins those continuation lines, so keep the indentation as copied. If you retype or reflow the text, you may split values incorrectly.

What Are the Limitations?

The analyzer reports what the header says, and a header can be forged. Lines added by the sender, especially the oldest hops, may be fake, while the lines added by your own mail provider are the most trustworthy. The tool does not look up the sending IP, confirm the DNS records or re-run authentication, and it does not confirm that a signature is valid. Spam Score, X-Mailer and similar rows appear only when the header contains them. Use the result as strong evidence, not as a court verdict.

Paste your headers into the box above and click Analyze Headers to see where the message came from and how it was authenticated. For more checks on certificates, hashes and email security, browse the security and encryption tools collection.