Email Header Analyzer

Paste raw email headers to trace the delivery path, check authentication results, and find where delays happen.

How to Get Email Headers

Gmail

Open the email, click the three-dot menu in the top right, select "Show original." Copy everything from the top of the page.

Outlook (Web)

Open the email, click the three dots, select "View message source." Copy the full header text.

Outlook (Desktop)

Open the email, go to File > Properties. The headers appear in the "Internet headers" box at the bottom.

Apple Mail

Open the email, go to View > Message > All Headers. Or use View > Message > Raw Source for the complete source.

SPF Record Checker

Validate a domain's SPF record and check for common issues.

DMARC Record Checker

Look up and analyze DMARC policy, reporting, and alignment.

Frequently Asked Questions

How do I find email headers?

In Gmail, open the email, click the three dots menu, and select "Show original." In Outlook, open the email, click File > Properties and find the Internet Headers box. In Apple Mail, go to View > Message > All Headers. Copy the full header text and paste it into the analyzer above.

What do email headers tell you?

Email headers reveal the complete delivery path from sender to recipient, including every server that handled the message, timestamps at each hop, authentication results (SPF, DKIM, DMARC), the sender's IP address, and the email client used. They are essential for troubleshooting delivery issues and identifying spoofing attempts.

What does "Received:" mean in email headers?

Each "Received:" header represents one hop in the email's journey. They are added by each mail server that handles the message, with the most recent hop at the top. By reading them bottom-to-top, you can trace the full path from the sender's server to your inbox, including timestamps that reveal any delays.

How can I tell if an email is spoofed from the headers?

Look for authentication failures — if SPF, DKIM, or DMARC show "fail" results, the email may be spoofed. Also check if the "From" address matches the envelope sender (Return-Path), and whether the originating IP matches the claimed sender's domain. Mismatches are red flags.

Why is there a delay in my email delivery?

Compare the timestamps in each Received header to find where the delay occurred. Common causes include greylisting (intentional delay by receiving servers), spam scanning, DNS lookup timeouts, server queuing during high load, and content filtering. Delays over 30 seconds at a single hop warrant investigation.