How to Use the Email Header Analyzer

Copy the original source of the message from your email app and paste it into the analyzer.

Open the message source in your email app, such as Show original in Gmail or View, Message, Raw Source in Apple Mail.
Copy the header block, or the whole original message, and paste it into the box.
Select Analyze headers to read the hop table and the authentication rows.
Export the hop table as CSV if you need to share it with your mail provider.

Email Header Analysis Explained

Email header analysis turns the raw header block into a delivery route, authentication results and sender comparisons you can read at a glance.

Message Delay Between Hops

Each Received line ends with the time a server accepted the message. The analyzer orders the hops from first to last and subtracts adjacent timestamps to show the delay in seconds. A negative delay usually means the two servers' clocks disagree, not that the message travelled back in time.

SPF, DKIM and DMARC Results

The analyzer reads the spf, dkim and dmarc values from every Authentication-Results header and marks a fail as a warning. Trust only the result added by your own receiving provider, because a sender can insert a fake header further down. To check the records behind a result, open the SPF, DKIM or DMARC checker.

Sender IP Address

The earliest visible IP address is taken from the first Received hop. It often belongs to the sender's mail server, but webmail services and relays can hide the original device. Look it up with the Reverse DNS Lookup to see the host name the address claims.

Phishing Signs in Email Headers

A Return-Path or Reply-To domain that differs from the From domain is flagged for review. Mailing services often use their own Return-Path, so a difference can be legitimate. A Reply-To that sends your answer to an unrelated domain deserves more suspicion.

Frequently Asked Questions

What Is Email Header Analysis?

It is reading a message's metadata to see which servers handled it, when, and whether it passed authentication. The analysis shows what the headers claim, and headers added before your provider received the message can be forged.

How Do You Analyze Email Header Information?

Read the Received lines from the bottom up to follow the route, then check the Authentication-Results header added by your provider. The analyzer does this ordering for you and puts the hops in a table.

Can an Email Header Analyzer Find the Sender’s Location?

Not reliably. This tool shows the earliest visible IP address but does not look up its location, and that IP often belongs to a mail provider rather than the person who wrote the message.

Are Email Headers Metadata?

Yes. They hold addresses, server names, IP addresses and timestamps about the message rather than its content. This analyzer processes them in your browser and does not upload them.

Can I Analyze an EML File?

Open the .eml file in a text editor and paste its contents here, because the analyzer reads everything up to the first blank line as the header block. To view the body and attachments as well, use the EML Viewer.

Related Email Tools

EML Viewer Open an .eml file in your browser to read its headers, plain-text and HTML body, and download its attachments. Scam Email Checker Review a suspicious message for urgency, credential requests, deceptive domains and link mismatches. Reverse DNS Lookup Find the PTR hostname of an IPv4 or IPv6 address and check that the hostname resolves back to the same address. DKIM Checker Look up a domain’s DKIM public key by selector, or try 21 common selectors, and check the key type and size. DMARC Checker Look up a domain’s DMARC record, validate every tag and see which policy it asks receivers to apply. Email Blacklist Check Check an IPv4 address or a domain and its mail servers against public DNS blocklists, with refused lookups reported as unavailable.

Continue with the guide How to Read Email Headers. Trace delivery and interpret authentication.