Email header analyzer
A message lands in spam, arrives late or looks spoofed? Paste its full headers: the tool rebuilds the path it took with the delay and encryption of each hop, reads the SPF, DKIM and DMARC results, checks alignment with the sender and flags spam and spoofing signals.
What the tool does
Delivery path
Rebuilds the hops (Received) from oldest to newest, with the time, the delay between hops, the protocol and TLS encryption, and flags delays and skewed clocks.
SPF, DKIM, DMARC
Reads Authentication-Results and Received-SPF, details DKIM signatures (domain, selector, algorithm, signed headers) and offers to check the key in the DNS tool.
Alignment and spoofing
Checks that the validated domain matches the "From" address, spots a display name containing another address, a different Reply-To or Return-Path.
Spam and bulk mail
Interprets X-Spam-Status, Exchange SCL, X-Forefront-Antispam-Report and List-Unsubscribe headers (one-click unsubscribe).
How to use it
Copy the full headers of the message from your mail client, paste them and run the analysis. Each finding is explained with what to do. A legitimate message shows fast, encrypted hops, with SPF or DKIM validated and aligned with the displayed sender.
FAQ
Where do I find an email's headers?
Gmail: ⋮ menu of the message then "Show original". Outlook: double-click the message, File > Properties. Thunderbird: View > Message Source. Copy everything before the first blank line.
Why does SPF pass when the message is phishing?
SPF validates the technical envelope domain (Return-Path), which the sender chooses. Only alignment with the displayed "From" address (DMARC) shows the message really comes from the domain it claims.
Privacy
The headers you paste never leave your computer. They may contain addresses and IP addresses: feel free to mask them before sharing.