Email Header Analyzer
Paste the raw headers from any email to see how it was authenticated and which servers it passed through.
Authentication Results
From / Return-Path
–
Received Hop Chain
| Hop | From → By | Delay |
|---|
Reads only what you paste, nothing is sent anywhere. Auth results reflect the mail server's own decision, not a live check.
Related: the user-agent parser for parsing other raw strings.
Runs entirely in your browser. Nothing you paste is sent anywhere.
Learn about email headers
What raw headers actually show
Raw headers record every hop a message took on its way to your inbox. Each server it passed through adds its own Received line, and reading them from the bottom up gives you the chronological order the message actually traveled in. Headers also carry the authentication results, SPF, DKIM, and DMARC pass or fail, that the receiving server checked along the way.
Reading your results
The bottom-most Received header is closest to where the message originated. The top-most is the final hop into your inbox. The Authentication-Results header summarizes what the receiving server decided about SPF, DKIM, and DMARC, and is usually the fastest place to check whether a message actually authenticated properly.
Common questions
Why are there so many Received headers for one email? Every hop adds one: the sending server, any relay in between, a spam filter, and the final delivery server. A handful of them is completely normal.
The From address looks right, but SPF still failed. What does that mean? SPF actually checks the envelope sender (the Return-Path or MAIL FROM address), which can differ from the visible From header a person sees. A mismatch there, without proper alignment, is exactly the gap DMARC is designed to catch.
Can headers be faked? Yes, anything added before a message enters a mail system you actually trust can be forged. Headers added by servers you trust, and anything backed by a valid DKIM signature, are the reliable parts.