← devnestio

Email Header Analyzer RFC 5322

Raw Email Headers

0 headers

Analysis

Paste email headers and click Analyze

What is Email Header Analyzer?

Email Header Analyzer parses raw email headers and explains them in plain English: sender authentication results (SPF, DKIM, DMARC), the relay chain (which servers the email passed through with timestamps), spam score indicators, message routing delays, and flags for common phishing indicators. Paste full email headers (available in Gmail, Outlook, and Apple Mail) to diagnose delivery issues or investigate suspicious emails.

Email headers contain metadata added by every server that handles the message. The Received headers form a chain from bottom (original sender) to top (final recipient) — each server adds its Received header when it accepts the message. The Message-ID is a unique identifier assigned by the sending server. Authentication headers (Authentication-Results) show the results of SPF, DKIM, and DMARC checks performed by the receiving server.

Phishing indicators in headers: the From header display name says 'PayPal' but the actual email address (in <>) is @random-domain.com. The Received chain shows the email originated from an unexpected country or IP. DKIM signature is missing or fails verification. The Reply-To header points to a different domain than From. X-Mailer headers may reveal bulk mail tools. Headers are the first line of email security investigation.

How to Use

  1. Copy raw email headers from your email client (Gmail: three dots → 'Show original'; Outlook: File → Properties).
  2. Paste the raw headers into the text area and click 'Analyze'.
  3. Read the authentication summary at the top: SPF, DKIM, DMARC pass/fail status.
  4. View the relay chain in chronological order to see where the email traveled.
  5. Check the 'Phishing indicators' section for red flags in the header data.

Examples

Check if email is authentic

Result: SPF: pass, DKIM: pass, DMARC: pass → email is likely authentic from claimed sender

Find email delay

Result: Compare timestamps in Received chain → delay of 47 minutes at server 3.smtp.example.com

Spot phishing

Result: From: 'support@paypal.com' but envelope sender: notification@phish-site.ru → SPOOFED

Frequently Asked Questions

What is the difference between the 'From' header and the envelope sender?

The From header is the display address visible in your email client — it can be set to anything and is easy to spoof. The envelope sender (Return-Path or MAIL FROM) is the actual address used in the SMTP conversation — this is what SPF checks. In a phishing email, the From says 'support@paypal.com' but the Return-Path reveals the real sending domain. Email clients that show only the display name (not the address) make spoofing easier to pull off.

What are Received headers and how do I read them?

Each Received header is added by a server when it receives the email, showing the server it received from, the server receiving it, and a timestamp. They're stacked newest-first (top of headers = most recent). To trace delivery chronologically, read from bottom to top. The first Received header (bottom) shows the originating server — this is the true origin of the email. Subsequent headers show its path through intermediate mail servers.

How does DMARC prevent email spoofing?

DMARC (Domain-based Message Authentication, Reporting & Conformance) requires the domain in the From header to align with either the SPF domain or the DKIM signature domain. This prevents spoofers from setting From: support@paypal.com while sending from their own server (which might pass SPF for their domain but not PayPal's). With DMARC p=reject, PayPal's email servers can instruct receiving servers to reject emails that fail DMARC alignment.

What is the X-Spam-Score header?

Many mail servers add X-Spam-Score (or X-Spam-Status, X-SpamAssassin-Status) headers showing the spam score assigned by their spam filter. Scores below a threshold (typically 5.0 for SpamAssassin) are delivered; above the threshold goes to spam. Individual check results show what contributed to the score: DKIM_INVALID (+0.1), NO_RECEIVED_FROM (+1.5), HTML_MESSAGE (+0.001), etc. A score of 5+ generally indicates high spam likelihood.

How can I tell if an email claiming to be from a company is real?

Check: (1) Authentication-Results in the headers — SPF, DKIM, and DMARC should all pass. (2) The DKIM signature domain should match the From address domain. (3) The Return-Path should match the From domain or a known subdomain. (4) The bottom Received header should show an IP belonging to the company's mail service. (5) In Gmail, click the lock icon next to the sender — 'Standard encryption (TLS)' is expected; 'No encryption' is a red flag.

Related Tools