What does an email header tell you?

The headers record every server that handled the message, when each one took it, and what the final server found when it checked SPF, DKIM and DMARC. That gives you the route, the delays along it, and whether the sender was who the From: line claims.

Can email headers be faked?

Every header below the topmost Received line can be forged, because each server only adds its own line and trusts nothing beneath it. The line added by your own mail provider is the one you can rely on, along with the Authentication-Results it wrote.

Why did an email take an hour to arrive?

Compare the timestamps between hops. A gap of several minutes on a first message to a recipient is usually greylisting: the receiving server rejected the first attempt on purpose and accepted the retry. A long gap at your own outbound server means the queue backed up.

Email header analyzer

Paste the raw headers from a message. You get the route it took, how long it waited at each stop, and what the receiving server concluded about SPF, DKIM and DMARC.

Paste the full header block

In Gmail: open the message, then More, then Show original. In Outlook: File, Properties, Internet headers. Parsing happens in this tab, so nothing you paste is sent anywhere.

Paste a header block above and the message path, the per-hop delays and the SPF, DKIM and DMARC results appear here.

What this cannot tell you

It cannot tell you whether a header is true. Each server adds one line and trusts nothing below it, so everything under the topmost Received line was written by machines you have no reason to trust. A forged chain looks exactly like a real one.

It cannot tell you where a sender physically is. The first IP in the chain is the machine that handed the message to a mail server, and on anything sent through a webmail client that machine is the provider, not the person.

An spf=pass here means the receiving server checked SPF at the moment it accepted the message. It does not mean the sender is honest. Plenty of spam passes SPF, because the spammer owns the domain they published the record for.

And it cannot verify whether the recipient address exists. That takes an SMTP conversation with the receiving server, which is what an SMTP check does and no browser can.

How to read what comes back

Start at the bottom of the hop table. Hop 1 is the first server that handled the message, and the chain reads upward from there to your own mailbox. Mail clients show the headers in the opposite order, newest first, which is why the route looks backwards when you read the raw block.

The delay column is the part people come here for. Each figure is the gap between one server's timestamp and the next one's. A few seconds is normal. A gap of four or five minutes on a first contact is almost always greylisting: the receiver refused the first attempt on purpose to see whether a real sender would come back. Legitimate senders retry, spam software often does not.

Clock drift makes some delays look strange. Servers set their own time, and one running a minute fast produces a negative gap. If a single hop shows a delay that cannot be right, the clock is the likely explanation rather than anything sinister.

The authentication block comes from the Authentication-Results header, which the last server wrote when it accepted the message. It records what that server found, not what is true now. Re-checking the domain today can give a different answer, because records change. That is what the SPF checker and DMARC checker are for.

One more thing worth noticing: the Return-Path and the From: domain are often different. That is how every marketing platform works, and it is also how a spoofed message looks. DMARC alignment is the check that separates the two, so read the dmarc line before you decide anything.

Where to find the headers

In Gmail, open the message, use the three-dot menu, and pick Show original. The page that opens has a Copy to clipboard button under the headline figures.

In Outlook on the desktop, open the message in its own window, then File, then Properties. The block sits in the Internet headers box at the bottom, and it does not scroll well, so select all of it before you copy.

In Apple Mail, turn on View, then Message, then All Headers. In most other clients the wording is some version of "view source" or "show original".

Questions people ask

Is anything I paste sent to your servers?

No. The parsing runs in this tab, in JavaScript, and nothing is uploaded. That matters here more than on most tools, because a header block carries the recipient's address and the hostnames of their internal mail estate.

The chain shows an internal IP like 10.4.2.19. Is that useful?

It tells you the message started inside a private network, usually from a workstation or an application server. The address means nothing outside that network, and it is common in mail sent from an office or a monitoring system.

Does dkim=fail mean the message was tampered with?

Usually not. The most common cause is a forwarder or a mailing list that rewrote the subject line or appended a footer after the message was signed. Genuine tampering looks identical at this level, which is why alignment and the rest of the chain matter.

Why are there two Authentication-Results headers?

Because the message passed through more than one system that checked it, or because it was forwarded and ARC carried the earlier results forward. We show every set and name the server that recorded each one.

Other tools

Headers explain one message. A list needs the other check.

Verification opens an SMTP connection and asks the receiving server about the address, then reports what it could not settle.

Browse the free tools What unknown means