← ALL TOOLS
// RECON & INTEL · BROWSER

Email Header Analyser

Parse raw email headers: the Received hops, SPF, DKIM and DMARC results and the sending path.

RECON · IN YOUR BROWSER

Runs in your browser; nothing you type leaves this page. Too long to share as a link.

HISTORY

Your last 5 runs appear here for 7 days, on this device only.

RESULT

Fill in the form and run the tool; the result appears here.

Email Header Analyser parses raw headers you paste from an email into a hop-by-hop delivery path, showing each mail server the message passed through, the delay at each hop, and the SPF, DKIM and DMARC verdicts recorded along the way.

How to read the result

The Received chain reads bottom to top in the raw source but is shown here in delivery order, each hop naming the sending and receiving server and the time between hops, which is where you spot an unusual delay or an unexpected relay. The SPF, DKIM and DMARC results (pass, fail, softfail and so on) are pulled out of the Authentication-Results header, or Received-SPF for SPF, so you do not have to parse them by hand. They are the receiving server's own verdicts: this tool reads them, it does not re-check them.

The originating IP is the first bracketed address in the oldest hop that carries one. It is often the sender's own mail server rather than their device, and large providers often hide it behind their own relays.

Defender tips

  • Publish SPF and DKIM for every domain that sends mail, then move DMARC from p=none to p=quarantine and eventually p=reject once reports confirm nothing legitimate is failing.
  • Treat a From address that does not match the Return-Path or the authenticated sending domain as suspicious by default; header analysis is exactly how that mismatch is normally caught.
  • Investigate hops with unusually long delays; they can indicate queuing at a compromised or misconfigured relay rather than ordinary network latency.

FAQ

Where do I get the raw headers?

Most mail clients have a "view source" or "show original" option on an individual message; copy the full header block from there, not just the visible From/To/Subject line.

Does this tool send or receive email?

No. You paste headers you already have and everything is parsed client-side; it never connects to a mail server.

Why is the originating IP sometimes missing?

Large providers (webmail services in particular) often do not expose the sender's original connecting IP in headers visible to the recipient, for their own users' privacy.