Email Header Analyzer

How email header analysis works

Every email that traverses the internet carries with it a set of metadata headers that record the entire delivery journey. When you send an email from your Mail User Agent (MUA), it is submitted to a Mail Submission Agent (MSA), which relays it through one or more Mail Transfer Agents (MTAs) until it reaches the recipient's incoming mail server. Each server that handles the message adds a "Received" header to the top of the email, creating a chronological chain from the destination back to the source. Reading this chain from bottom to top reveals the path the email took across the internet.

Beyond the routing information, email headers contain critical authentication data that helps receivers determine whether the message is legitimate or fraudulent. The Sender Policy Framework (SPF) header records which IP addresses are authorized to send mail for the domain. DomainKeys Identified Mail (DKIM) adds a digital signature that cryptographically binds the email to the sending domain. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells the receiving server how to handle messages that fail SPF or DKIM checks — whether to deliver them anyway, quarantine them, or reject them outright.

This tool extracts all of this information from the raw headers you paste. It parses the header block line by line, identifying known header fields and extracting their values. The Received headers are processed in reverse order (from the last MTA back to the original sender) to reconstruct the delivery path. Timestamps from each Received header are compared to calculate the delay introduced by each intermediate server. The authentication results are extracted from the Authentication-Results header, which mail servers add after performing SPF, DKIM, and DMARC checks.

Why email header analysis is important

Email headers contain the forensic evidence needed to determine whether a message is legitimate or malicious. Phishing emails often spoof the display name or email address of a trusted contact, but the headers reveal the true origin. By examining the Received chain, you can see the actual IP addresses the message passed through, which often differ from the claimed sender domain. The authentication headers — SPF, DKIM, and DMARC — provide an automated mechanism for detecting spoofing attempts. An email that claims to be from a bank but fails SPF and DKIM checks is almost certainly fraudulent.

System administrators responsible for email infrastructure use header analysis to troubleshoot delivery problems. If legitimate emails are being marked as spam or rejected entirely, examining the headers reveals which authentication check is failing. The delay between each hop helps identify bottleneck servers: a 30-second gap between two Received headers points to a specific MTA that is slow to process or relay messages. This information is invaluable for diagnosing email delivery performance issues and optimizing mail server configurations.

Email headers also document the security of the transmission path. Many receiving servers add an "ESMTPS" indicator in the Received header to confirm that the connection from the previous hop was encrypted with TLS. By reviewing these indicators, you can verify whether all hops in the delivery chain used encrypted transport. An email that passed through any unencrypted hop could theoretically have been intercepted or modified in transit, which is especially concerning for sensitive communications.

When to use an email header analyzer

Security-conscious users should analyze email headers whenever they receive a suspicious message. By pasting the raw headers into this tool, you can quickly determine whether the email actually came from the claimed sender or is a sophisticated phishing attempt. IT support teams helping users who receive suspicious emails can ask them to forward the raw headers for analysis, providing objective evidence about the email's authenticity that can guide the response — whether that is ignoring the message, reporting it, or escalating to incident response.

Email marketers and deliverability specialists use header analysis to ensure their campaigns are reaching inboxes rather than spam folders. If email open rates suddenly drop, examining the headers from test sends can reveal whether the DKIM signature is correctly configured, whether the sending IP has good reputation, and whether any intermediate servers are adding or modifying headers. DMARC failure reports help identify unauthorized use of the sending domain, such as spoofing attempts or misconfigured third-party senders.

The tool is equally useful for learning. Students of networking and system administration can dissect real email headers to see SMTP in action. Each Received header documents a real SMTP transaction between two mail servers, complete with the protocol version (ESMTP, ESMTPS), the server hostnames, IP addresses, and timestamps. This practical understanding of email routing is difficult to gain from textbooks alone but immediately accessible through the raw headers of any email you have received.

Frequently asked questions