Email Header Analyzer
Analyze raw email headers online: the Received route with delays and trust boundary, SPF, DKIM and DMARC results, alignment checks, the most likely origin server with reputation and a plain-language verdict on whether the message is forged.
What the header analysis shows
Every email carries a hidden log of its journey. Each mail server that handles the message adds a Received: line on top, and the receiving server writes down whether the sender passed SPF, DKIM and DMARC. This tool reads that log for you and turns it into plain language: which server really sent the mail, from which network, how long it took, and whether the claimed sender is backed by any proof.
Nothing is stored. The headers are parsed once, the sending IP is looked up and the result is returned to your browser.
How to read the result
- Verdict summarises the strong and weak warning signs. "Suspicious" means at least one hard failure such as SPF fail or a display name that imitates another address.
- Authentication lists SPF, DKIM and DMARC as recorded by the receiving server. These lines are only trustworthy when the mail came through your own mail system, since anyone can type them into a forged message.
- Route shows the hops from the first server to your inbox, oldest first, with the delay at each step. Long gaps usually mean queues or greylisting, not fraud.
- Likely origin is the address the message most probably came from, with reverse DNS, network owner and a blocklist check. It is a heuristic with a confidence rating, not a proven author.
- Trust boundary: hops marked "your server" were written by the receiving mail system and can be trusted. Hops marked "sender side" were written by other systems and could be forged.
How the origin is determined
Only the Received lines added by your own mail system are trustworthy. Everything below them was written by other servers and can be invented by a sender. The analyzer therefore looks for the point where the message entered your mail system: the address your server checked with SPF, or the host that connected to it. That address is the likely origin.
Mail often passes through relays first, a forwarding rule, a mail gateway, Google Workspace in front of Exchange. Then the likely origin is the last relay, not the author. The earliest public hop is shown separately as an unverified hint, and the confidence rating tells you how much the evidence agrees. Treat the result as the most probable origin, not as proof.
Typical signs of a forged message
- SPF or DMARC fail, or a DKIM signature from an unrelated domain.
- Reply-To pointing to a different domain than From, so answers reach the attacker.
- A display name that contains a well-known address while the real address is something else.
- No Message-ID, or a Date header hours away from the first Received timestamp.
- The likely origin sitting on a hosting network or in a blocklist while the mail claims to come from a bank or a colleague.