Email Header Analyzer
Email Header Analyzer
Parse raw email headers and display them in a structured view: routing chain (Received hops with timestamps and delays), authentication results (SPF, DKIM, DMARC pass/fail), DKIM signature details, and a searchable all-headers table.
Parse raw email headers to inspect authentication (SPF/DKIM/DMARC), routing hops, and all header fields.
Email Header Analyzer
Parse raw email headers and display them in a structured view: routing chain (Received hops with timestamps and delays), authentication results (SPF, DKIM, DMARC pass/fail), DKIM signature details, and a searchable all-headers table.
Common uses
- Trace the routing hops of a suspicious email
- Check SPF/DKIM/DMARC results for an email
- Inspect DKIM signature headers
- Find the origin IP of a phishing email
Also searched as
- email header analyzer online
- trace email origin ip from headers
- check spf dkim dmarc result in email headers
- gmail show original analyze headers
- analyze received headers delay
- phishing email header check
- why did my email go to spam headers
- dmarc record lookup domain
- spf record check
- dkim signature details viewer
Frequently asked questions
Is my data uploaded to a server?
Partially. The Domain Auth Checker tab sends the domain you enter to Cloudflare's DNS-over-HTTPS resolver to look up SPF/DMARC/DNSSEC records — that's unavoidable for a real lookup. The Analyzer and Reference tabs are fully local.
How do I analyze email headers?
Copy the raw headers (for example Gmail's Show original) and paste them in. You get the routing chain with per-hop timestamps and delays, plus SPF, DKIM and DMARC results.
How can I find the origin of a suspicious email?
Review the Received hops from bottom to top in the routing chain to see where the message came from. Headers can be forged, so treat the earliest hops with care.
Can I check a domain's email authentication?
The Domain Auth Checker tab checks a domain's authentication setup, and the Reference tab explains the headers.