Logo

MonoCalc

/

Email Header Analyzer

Networking
Paste the full raw email headers. In Gmail: open message → three-dot menu → Show original.

Load a Sample

About This Tool

Email Header Analyzer – Trace Routing, Verify Authentication, and Detect Spam

Every email message carries a set of invisible headers — structured metadata fields appended by each mail server that processes the message. These headers record the routing path, authentication results, spam filter verdicts, and dozens of other details that help diagnose delivery problems, identify spoofed senders, and understand how a message was handled in transit. This Email Header Analyzer parses raw email headers and presents each field with a plain-English explanation so you can quickly make sense of what happened to a message.

How to Find Your Email Headers

The method varies by mail client:

  • Gmail: Open the message, click the three-dot menu (⋮) in the top-right corner, and select Show original. Copy everything from the top of the page down to the blank line before the message body.
  • Outlook (Desktop): Open the message, go to File → Properties, and copy the Internet headers field.
  • Apple Mail: Open the message and go toView → Message → All Headers (or press Shift+Cmd+H).
  • Thunderbird: Open the message and press Ctrl+U (Cmd+U on Mac) to view the raw source including all headers.

Understanding the Routing Path

The Received header is added by every mail server that relays the message from sender to recipient. Servers appear in reverse order — the most recent hop is at the top. The analyzer reads these in chronological order and displays them as a numbered routing path, showing the sending server (from), the receiving server (by), the protocol (with ESMTPS, etc.), and the timestamp. Where timestamps are available, the delay between consecutive hops is calculated and highlighted. Delays over 30 seconds may indicate a slow relay, greylisting, or spam-filtering queue.

Some providers — notably Google — also add X-Received headers for internal routing steps. The analyzer includes these in the hop count for a complete picture of the delivery path.

SPF, DKIM, and DMARC Authentication

Modern email authentication relies on three complementary standards that are reported in the Authentication-Results header:

  • SPF (Sender Policy Framework) — Checks whether the sending IP address is listed in the sender domain's DNS TXT record as an authorised mail server. A spf=pass result means the sending server is permitted; spf=failor spf=softfail may indicate a spoofed sender address.
  • DKIM (DomainKeys Identified Mail) — Verifies a cryptographic signature added by the sending domain's mail server. A dkim=pass result confirms that the message body and key headers have not been altered in transit and that the signing domain takes responsibility for the message.
  • DMARC (Domain-based Message Authentication, Reporting & Conformance)— Builds on SPF and DKIM to give domain owners control over what happens to unauthenticated mail. A dmarc=pass result means at least one of SPF or DKIM aligns with the From domain. The DMARC policy (p=reject,p=quarantine, or p=none) tells receivers what to do with failures.

Reading Spam Filter Results

Many mail servers run SpamAssassin or a similar content filter and record the verdict in headers like X-Spam-Status, X-Spam-Score, andX-Spam-Flag. The analyzer surfaces the spam score and flag prominently in the summary. A typical threshold for marking mail as spam is a score of 5.0, though server administrators can raise or lower this value. A high spam score combined with failed SPF, DKIM, or DMARC checks is a strong signal that a message is fraudulent or unsolicited.

Common Use Cases

Diagnosing Delayed or Undelivered Messages

When a recipient reports that an email was late or never arrived, the routing path reveals exactly where the delay occurred and which server last handled the message before delivery failed. If the last Received header shows your outgoing mail server but no subsequent hop, the problem likely lies with the recipient's domain — possibly a full mailbox, a filtering rule, or a DNS misconfiguration.

Investigating Phishing and Spoofed Emails

Attackers frequently forge the From display name or address to impersonate a trusted sender. Checking the authentication headers quickly reveals whether the sending IP is actually authorised for the claimed domain (SPF) and whether the message was signed by that domain (DKIM). A combination of spf=fail anddkim=none alongside a suspicious routing path is a reliable indicator of a spoofed or phishing message.

Verifying Your Own Mail Configuration

After configuring SPF, DKIM, and DMARC records on your domain, send a test message and paste the received headers into this analyzer. The Authentication-Results block will confirm whether all three checks pass, saving you from repeatedly consulting DNS debugging tools.

Privacy and Security

All parsing and analysis runs entirely in your browser. Your email headers — which may contain sender addresses, session tokens, internal server names, and recipient details — are never transmitted to any external server. You can safely analyze headers from sensitive or confidential messages.

Frequently Asked Questions

Is the Email Header Analyzer free?

Yes, Email Header Analyzer is totally free :)

Can I use the Email Header Analyzer offline?

Yes, you can install the webapp as PWA.

Is it safe to use Email Header Analyzer?

Yes, any data related to Email Header Analyzer only stored in your browser (if storage required). You can simply clear browser cache to clear all the stored data. We do not store any data on server.

How does the Email Header Analyzer work?

Paste the full email headers (copied from your mail client's 'Show original' or 'View source' option) into the input area and click Analyze. The tool parses each header field, identifies its category (routing, authentication, spam filter, etc.), explains what it means, and reconstructs the routing path from the Received headers.

Where do I find the full email headers?

In Gmail, open the message, click the three-dot menu, and choose 'Show original'. In Outlook, open the message, go to File → Properties and copy the Internet headers. In Apple Mail, go to View → Message → All Headers. In Thunderbird, open the message and press Ctrl+U (Cmd+U on Mac).

What do SPF, DKIM, and DMARC results mean?

SPF (Sender Policy Framework) verifies that the sending IP address is authorised to send email for the domain. DKIM (DomainKeys Identified Mail) uses a cryptographic signature to confirm the message has not been altered in transit. DMARC ties SPF and DKIM together and specifies what the receiving server should do with messages that fail — report, quarantine, or reject them.

How do I interpret the routing path and delays?

Email is relayed through multiple servers, and each server adds a Received header. The tool lists these hops in chronological order (oldest first) and shows the delay between each hop where timestamps are available. Large delays — anything over 30 seconds — can indicate a slow or overloaded server along the route.

What does a high spam score mean?

Many mail servers run SpamAssassin or a similar filter and record the score in X-Spam-Score. Scores above 5 are commonly classified as spam, though thresholds vary by server. A high score alongside failed SPF/DKIM/DMARC checks strongly suggests the message is fraudulent or unsolicited.

Is my email header data kept private?

Yes. All analysis is performed entirely in your browser using JavaScript. Your header data — including sender addresses, authentication tokens, and routing information — is never transmitted to any external server.