Email Header Analyzer
Parse email headers to trace message routing, detect spoofing, and check authentication. Extracts sender/recipient, hop-by-hop routing, SPF/DKIM/DMARC results, and message metadata. 100% browser-based — headers never leave your device.
All parsing runs in your browser. Email headers are not transmitted to any server. Headers may contain IP addresses and server names — they are processed locally and never stored.
Key Facts
- What Headers Contain: Sender/recipient addresses, subject, date, message ID, MIME type, server routing trail, authentication results, and spam scores
- Received Headers: Each mail server adds a "Received:" line per RFC 5321 (SMTP standard, updated 2008). Reading bottom-to-top traces the message from origin to inbox. A typical email traverses 3-5 hops
- SPF: Sender Policy Framework (RFC 7208, published 2014) verifies the sending server is authorized. Approximately 93% of domains in the Alexa top 1 million publish SPF records as of 2024
- DKIM: DomainKeys Identified Mail (RFC 6376, published 2011) uses RSA or Ed25519 cryptographic signatures. DKIM adoption reached approximately 85% among top email senders by 2024
- DMARC: Domain-based Message Authentication (RFC 7489, published 2015) combines SPF + DKIM. Only approximately 58% of domains have DMARC records, yet DMARC enforcement reduces spoofing by up to 90% according to Valimail research
How to Find Email Headers
- Gmail: Open email → Click ⋮ (three dots) → "Show original" → Copy the headers
- Outlook (Web): Open email → Click ⋯ (three dots) → "View" → "View message source"
- Outlook (Desktop): Open email → File → Properties → Copy "Internet headers" box
- Apple Mail: Open email → View → Message → All Headers
- Yahoo Mail: Open email → Click ⋯ → "View raw message"
- Thunderbird: Open email → View → Message Source (Ctrl+U)
How to Detect Email Spoofing
- SPF Fail: The sending server is not authorized by the domain's SPF record. Approximately 10% of legitimate emails fail SPF due to misconfigured forwarding, but SPF failure from unknown servers is a strong spoofing indicator
- DKIM Fail: The cryptographic signature does not match, meaning the email was altered or forged. DKIM uses 1024-bit or 2048-bit RSA keys. Google mandated 1024-bit minimum DKIM keys since 2016
- DMARC Fail: The email failed both SPF and DKIM alignment checks. The domain owner's policy may say to reject or quarantine it
- From vs Return-Path Mismatch: If the display "From:" address differs from the "Return-Path:" or envelope sender, the email may be spoofed
- Suspicious Received Chain: Unexpected countries, unusual server names, or IP addresses from known spam networks indicate potential compromise
Questions & Answers About Email Headers
Q: What are email headers?
Email headers are metadata attached to every email defined by RFC 5322 (Internet Message Format, originally published 2001, updated 2008). They include sender, recipient, subject, date, message ID, and a trail of servers. Headers also contain SPF, DKIM, and DMARC authentication results. A typical email contains 15-30 header lines.
Q: How do I find email headers in Gmail?
In Gmail, open the email, click the three-dot menu in the top right, and select "Show original." This opens a new tab with the full headers and raw message. Copy everything from the top and paste it into our analyzer. The "Show original" view also displays Google's own SPF, DKIM, and DMARC results at the top.
Q: What are SPF, DKIM, and DMARC?
SPF (RFC 7208, 2014) verifies the sending server is authorized. DKIM (RFC 6376, 2011) adds a cryptographic signature proving content integrity. DMARC (RFC 7489, 2015) combines both with a policy. Together, these 3 protocols reduce email spoofing by approximately 90%.
Q: Can email headers reveal the sender's real IP address?
Sometimes. The originating "Received:" header may contain the sender's IP address, especially for emails sent from personal mail clients or self-hosted servers. However, major webmail providers like Gmail and Outlook proxy all traffic and hide the sender's real IP, showing only their own server IPs.
Q: Are email headers trustworthy?
Partially. Headers added by your own mail server and upstream servers you trust are reliable. However, headers below the first trusted server can be forged. The M3AAWG (Messaging, Malware and Mobile Anti-Abuse Working Group) estimates that approximately 45% of global email is spam or phishing. This is why authentication checks (SPF, DKIM, DMARC) are critical — they provide cryptographic proof that cannot be easily faked.