📨 Email Header Analyzer
Paste raw email headers below. We'll trace the delivery path, verify authentication, and score the risk level.
Drop an .eml file here or click to browse
Or paste headers manually below
About the Email Header Analyzer
Every email carries hidden header data that records exactly how it traveled from the sender to your inbox. Our free email header analyzer decodes those headers into plain English, showing the true origin IP, the mail servers it passed through, and whether the message passed authentication checks like SPF, DKIM, and DMARC.
This is one of the fastest ways to tell whether an email is legitimate or a spoofing attempt. Phishing emails often forge the visible "From" address, but the underlying headers are much harder to fake. By tracing the relay chain and checking authentication results, you can spot mismatches that reveal a forged message before you act on it.
To use it, copy the full raw headers from your email client (in Gmail: open the message, click the three-dot menu, choose "Show original") and paste them in. You get an instant, private breakdown with a risk score. Nothing is stored.
Frequently asked questions
What is an email header?
An email header is the technical metadata attached to every message: the sending server, relay path, timestamps, and authentication results such as SPF, DKIM, and DMARC. It is normally hidden by email apps.
What do SPF, DKIM, and DMARC mean?
They are email authentication standards. SPF checks the sending server is authorized for the domain, DKIM verifies the message was not altered using a cryptographic signature, and DMARC ties them together and tells receivers how to handle failures.
How do headers reveal phishing?
Scammers spoof the visible sender, but headers expose the real origin IP and server path. If authentication fails or the origin does not match the claimed domain, that mismatch is a red flag for phishing.