BYTETOOLS

Email Header Analyzer

Paste raw email headers to trace the delivery path hop by hop, see where mail stalled, and read the SPF, DKIM and DMARC verdicts — all offline.

Analysis

Paste a raw header block — or load the sample — to see the delivery path hop by hop, where the message stalled, and the SPF, DKIM and DMARC verdicts the receiving server recorded. Nothing you paste leaves your browser.

What is the Email Header Analyzer?

The Email Header Analyzer takes the raw header block from any message and turns it into something you can read.

  • Unfolds RFC 5322 continuation lines and reverses the Received chain into travel order
  • Per-hop from host, by host, IP addresses, protocol, UTC timestamp and delay
  • Highlights the slowest hop and warns when a timestamp runs backwards
  • Parses Authentication-Results and Received-SPF for SPF, DKIM, DMARC and ARC verdicts
  • Flags Reply-To and Return-Path domains that do not match the visible From
  • Surfaces X-Spam and Microsoft anti-spam headers, plus a full header dump

How to use the Email Header Analyzer

  1. 1

    Get the raw headers: “Show original” in Gmail, “View message source” in Outlook, or Message → Raw Source in Apple Mail.

  2. 2

    Paste the whole header block into the box, or click “Load sample headers” to see a worked example.

  3. 3

    Read the delivery path table — hops run oldest first, with the delay each one added.

  4. 4

    Check the authentication results and findings panels for SPF/DKIM/DMARC verdicts and Reply-To mismatches.

  5. 5

    Copy the plain-text report if you need to attach the analysis to a ticket.

About the Email Header Analyzer

The Email Header Analyzer takes the raw header block from any message and turns it into something you can read. It unfolds continuation lines, parses the Received chain into hops in the order the message actually travelled, and works out the delay between each pair so you can see exactly which server sat on the message.

It also pulls out the parts that matter for authentication and phishing triage: the SPF, DKIM and DMARC verdicts recorded in Authentication-Results and Received-SPF, the Message-ID, the Return-Path, whether Reply-To points somewhere other than From, and any X-Spam scoring the receiving filter added.

The message never leaves your browser. There is no upload, no API call and no logging, which is exactly what you want when the header you are examining came from a suspicious message or belongs to someone else's mailbox. A full header dump sits at the bottom of the page, and a copyable plain-text report gives you something to paste straight into a ticket or an incident write-up.

Frequently asked questions

How do I read an email header?

Start at the bottom. Received headers are added by each server as the message travels, and each new one goes on top, so the last Received line in the raw text is the first hop. This tool reverses them for you and shows the time gap between each pair.

Can I trust the IP addresses in an email header?

Only the ones added by servers you control or trust. A sender can invent as many Received headers as they like, and a forger will stuff the top of the chain with plausible-looking hops. The hop written by your own mail server is the only one that is definitely real.

Why is there a long delay between two hops?

Usually greylisting, a queue backlog, an antivirus or DLP scan, or a retry after a temporary 4xx rejection. The analyzer highlights the slowest hop so you can point at the specific server that held the message rather than guessing.

What does it mean when Reply-To is a different domain from From?

It can be perfectly normal — mailing lists and ticketing systems do it constantly — but it is also the single most common trick in business email compromise, where the display name looks legitimate and replies quietly go somewhere else. The tool flags the mismatch so you can judge it.

Why are there no SPF or DKIM results in my header?

Authentication-Results is added by the receiving server, so it only exists on the copy that server delivered. If the message was forwarded to you as an attachment, or you exported it from a client that trimmed headers, those verdicts will be missing.

Is the email I paste uploaded anywhere?

No. Parsing is plain JavaScript in your browser tab — no request is made and nothing is stored. That is deliberate, because header analysis usually happens on messages you would never want to hand to a third-party service.

Related tools