Free Email Header Analyzer Online

What is an Email Header Analyzer?

An email header analyzer is a browser-based tool that parses the raw header block of an email message, defined by RFC 5322, to reconstruct its delivery path. It unfolds wrapped header lines, walks each "Received:" trace field hop by hop, and surfaces the SPF, DKIM, and DMARC verdicts the receiving server already recorded.

The raw header block is the part of an email a normal inbox view hides: every server the message passed through, the exact timestamps at each hop, the sender's originating IP address, and the machine-readable authentication verdicts. Reading it is the standard first step in diagnosing delivery delays, tracing a message's real source, or investigating a suspected phishing attempt. See the SPF Record Checker and DMARC Record Checker for checking a domain's published policy rather than a specific message's headers.

How does this Email Header Analyzer work?

The tool first unfolds the pasted text: RFC 5322 section 2.2.3 allows a header field to wrap onto indented continuation lines, and those line breaks are removed before anything else runs. It then splits the block into individual header fields, extracts every "Received:" line in order, and parses each one for its from, by, with, id, and timestamp tokens.

Consecutive hop timestamps are diffed to compute the delay at each step and the total transit time. Sender IPs are pulled from the bracketed literal in the from field (both IPv4 [203.0.113.10] and IPv6 [2001:db8::1] forms). Finally, the tool reads any Authentication-Results header, defined by RFC 8601, lists the SPF, DKIM, and DMARC results it already contains, and pulls each verdict's ptype.property context (the IP an SPF check matched, or the domain a DKIM/DMARC check validated) from the same header field.

The Header Completeness Check runs against the same parsed field list: it looks for Message-ID, Date, Return-Path, Received-SPF, DKIM-Signature, Authentication-Results, and MIME-Version, and reports which ones are present. This is a completeness check on the pasted text, not a spoofing signal by itself, plenty of legitimate mail omits Received-SPF or MIME-Version.

Important: this tool does not perform its own SPF, DKIM, or DMARC verification. Doing that correctly requires querying DNS as the receiving mail server saw it at delivery time, which a browser cannot replicate after the fact. Instead, it displays the verdicts the receiving server already computed and stamped into the header, exactly as every major header analyzer does.

How to use this Email Header Analyzer

• Paste your headers: paste the full raw header block into the "Paste Raw Email Headers" box, or click the sample icon to load "Load sample headers".
• Click "Analyze Headers": the tool parses the block entirely in your browser and renders the results below.
• Review the summary: check the hop count, total transit time, any spoofing warnings, and the SPF, DKIM, and DMARC badges, each shown with the IP or domain it matched.
• Check header completeness: the Header Completeness Check lists which of the commonly expected headers, Message-ID, Date, Return-Path, Received-SPF, DKIM-Signature, Authentication-Results, and MIME-Version, are present in what you pasted.
• Scan the hop table, then drill in: the summary table shows every hop's From, To, protocol, timestamp, and delay at a glance; expand a hop card below it for the full raw fields and IP lookup.
• Look up a hop's IP (optional): click "Look up IP" on any hop to fetch reverse DNS, geolocation, and RDAP ownership for that address.
• Export the report: use the copy icon for a text summary or the download icon for a JSON report.

What this tool checks locally vs. what needs a network call

This page is built in two explicit tiers, and the widget tells you which one you are using:

• Always local, zero network calls: unfolding, hop parsing, delay math, IP extraction, key header extraction, reading the existing Authentication-Results header (including each verdict's matched IP or domain), and the Header Completeness Check all run in your browser's JavaScript with no network request at all.
• Opt-in, keyless lookups: clicking "Look up IP" sends only that one IP address to a public DNS-over-HTTPS resolver (for reverse DNS), an IP geolocation API, and an RDAP registry (for network ownership). Nothing is sent automatically when you paste headers.

There is no blacklist or spam-score check on this page. A real DNSBL check like Spamhaus blocks queries relayed through public DNS-over-HTTPS resolvers, so a browser-only tool cannot run one reliably, see the FAQ below for why.

Use cases of the Email Header Analyzer

• Debugging automated test or CI/CD notification emails: QA and DevOps teams can confirm hop counts, delays, and authentication verdicts for pipeline alert emails without leaving the browser.
• Investigating a suspected phishing email: trace the real originating hop and IP before deciding whether to report or block a sender.
• Troubleshooting deliverability complaints: confirm whether a message actually passed SPF, DKIM, and DMARC at the receiving server before escalating to your email service provider.
• Spotting slow relay hops: a multi-minute delay between two adjacent hops usually points to the specific server responsible for a delivery delay.
• Teaching how SMTP relaying works: a real header trace is a concrete way to show how a message actually moves between mail servers.

Understanding SPF, DKIM, and DMARC verdicts

These three mechanisms work together to authenticate a message, and this tool displays whatever the receiving server already decided for each one:

• SPF (RFC 7208) lets a domain publish which mail servers are allowed to send on its behalf. Try the SPF Record Checker to inspect a domain's published record directly.
• DKIM (RFC 6376) attaches a cryptographic signature to a message so the receiving server can verify it was not altered in transit and genuinely originated from the signing domain.
• DMARC (RFC 7489) ties SPF and DKIM results back to the visible From domain and tells receivers what to do on failure. Check a domain's policy with the DMARC Record Checker, or look up its mail servers with MX Lookup.

All processing on this page, including the hop trace, delay math, and Authentication-Results parsing, happens entirely in your browser. Nothing is uploaded unless you explicitly click the "Look up IP" button. Testing automated notification flows from your own QA pipelines pairs naturally with TestMu AI HyperExecute for orchestrating those jobs and TestMu AI Test Manager for tracking the results.