Developer

Email Header Analyzer

Summarize Received chains and auth hints from pasted headers.

Loading interactive tool…

Embed this tool on your site

About this tool

Email Header Analyzer on UtilityKit gives a quick text summary of raw email headers in your browser, without sending them to any external service. Paste the header block copied from Gmail, Outlook, Apple Mail or another client and click Analyze headers. The tool prints the From, Subject, Message-ID and Authentication-Results values, lists every Received line in the order it appears (top line is usually the hop closest to you), and adds heuristic hints: the number of Received hops, whether spf=pass, dkim=pass and dmarc=pass appear anywhere in the text, and a warning when a Reply-To header has no email address. It does not compute hop delays or total delivery time, look up reverse DNS, or name the originating IP, and it shows only the first physical line of each header, so folded header lines that continue on the next line are cut off. Read the listed Received lines yourself to follow the path and timestamps.

Why use it

  • Fast Header Triage: Pull the From, Subject, Message-ID and Authentication-Results values out of a long header dump in one click.

  • Phishing Investigation: The From: address in phishing emails is often spoofed. The pass/not-found hints and the listed Received lines help you decide whether to dig deeper into the sending infrastructure.

  • SPF & DKIM Spot Check: Confirm that spf=pass, dkim=pass and dmarc=pass appear in a message sent through a new service before tightening your DMARC policy.

  • Privacy-Safe Parsing: Headers often contain internal hostnames, IP addresses, and message IDs. All parsing runs in your browser — nothing is sent to external servers or logged.

  • Client-Agnostic: Works with headers copied from Gmail, Outlook, Apple Mail, Yahoo Mail, ProtonMail, or any email client that exposes raw headers in a selectable text block.

How to use

  1. Open the message in your email client. In Gmail: three-dot menu → Show original. In Outlook: File → Properties → Internet headers. In Apple Mail: View → Message → All Headers.
  2. Select all text in the raw headers view and copy it to your clipboard — this includes everything from the first Received line down to the blank line before the message body.
  3. Paste the header block into the Raw email headers box and click Analyze headers.
  4. Read the From, Subject, Message-ID and Authentication-Results lines at the top of the output. A value reads Not found when that header is missing.
  5. Read the Received chain: each Received line is numbered in the order it appears, so line 1 is usually the last hop and the bottom line is closest to the sender. Any IP or timestamp is shown only if it sits on that first line.
  6. Check the Heuristic hints for the hop count, whether SPF, DKIM and DMARC passes were found, and a Reply-To warning.

When it helps

  • When a transactional email (order confirmation, password reset) is reported as not delivered and you want a quick list of the Received hops it passed through.
  • When investigating a phishing email and you want to see quickly whether SPF, DKIM or DMARC passes appear and which servers are named in the Received lines.
  • When configuring a new email sending service (SendGrid, SES, Postmark) and you want to confirm spf=pass and dkim=pass appear in delivered mail.
  • When tightening a DMARC policy from p=none to p=quarantine or p=reject and you want to spot-check that test messages show dmarc=pass.
  • When a contact reports your email landed in their spam folder and you want the Authentication-Results line out of a long header dump.

Examples

Transactional email with SPF, DKIM and DMARC pass

Input
Received: from mx.example.net by mail.example.com; Tue, 14 Oct 2026 10:00:03 +0000
Received: from o1.sendgrid.net by mx.example.net; Tue, 14 Oct 2026 10:00:01 +0000
Authentication-Results: mx.example.net; spf=pass smtp.mailfrom=sendgrid.net; dkim=pass header.d=example.com; dmarc=pass header.from=example.com
From: Shop <orders@example.com>
Subject: Your order
Expected result · Scroll for more
From: Shop <orders@example.com>
Subject: Your order
Message-ID: Not found
Authentication-Results: mx.example.net; spf=pass smtp.mailfrom=sendgrid.net; dkim=pass header.d=example.com; dmarc=pass header.from=example.com

Received chain:
1. from mx.example.net by mail.example.com; Tue, 14 Oct 2026 10:00:03 +0000
2. from o1.sendgrid.net by mx.example.net; Tue, 14 Oct 2026 10:00:01 +0000

Heuristic hints:
1. 2 Received hop(s) found. First listed hop is usually closest to recipient.
2. SPF appears to pass.
3. DKIM appears to pass.
4. DMARC appears to pass.

Suspicious message with SPF fail

Input
Received: from unknown (185.220.101.7) by mx.example.net
Authentication-Results: mx.example.net; spf=fail smtp.mailfrom=paypal.com; dkim=none; dmarc=fail
From: support@paypal.com
Reply-To: support
Expected result · Scroll for more
From: support@paypal.com
Subject: Not found
Message-ID: Not found
Authentication-Results: mx.example.net; spf=fail smtp.mailfrom=paypal.com; dkim=none; dmarc=fail

Received chain:
1. from unknown (185.220.101.7) by mx.example.net

Heuristic hints:
1. 1 Received hop(s) found. First listed hop is usually closest to recipient.
2. SPF pass not clearly found.
3. DKIM pass not clearly found.
4. DMARC pass not clearly found.
5. Reply-To header looks unusual.

Tips

  • When diagnosing DMARC failures, check both SPF and DKIM alignment separately — a message can pass SPF but fail DMARC if the SPF domain does not align with the From: header domain.
  • The 'X-Originating-IP' or 'X-Forwarded-To' headers, when present, can reveal the true client IP even when the main Received chain is obscured by a privacy-preserving gateway.
  • If DKIM shows 'body hash did not verify', the message body was modified in transit — possibly by a mailing list, forwarding rule, or anti-virus gateway that appended a footer.
  • Compare the 'envelope-from' (Return-Path) domain with the 'From:' header domain. DMARC requires alignment between these two domains (for SPF) or between DKIM d= and From: domain.
  • If a Received line or the Authentication-Results value looks cut short, find the full folded header in the raw text; the analyzer only shows its first line.

Frequently Asked Questions

Where do I find raw email headers in Gmail?
Open the message, click the three-dot menu in the top-right corner of the email, and select 'Show original'. A new tab opens with the full raw message including headers. Select all and copy the text above the blank line that separates headers from the body.
What does SPF pass or fail mean?
Sender Policy Framework (SPF) checks whether the sending mail server's IP address is listed in the DNS SPF record of the domain in the envelope-from address. A pass means the IP is authorised; a fail or softfail means it is not, which typically indicates a spoofed or misconfigured sender.
What is DKIM alignment?
DKIM alignment (used by DMARC) means the domain in the DKIM d= tag matches the domain in the message's From: header. A valid DKIM signature that signs a different domain does not satisfy DMARC alignment even if the signature itself is cryptographically valid.
In what order is the Received chain shown?
In the same order as the raw headers. Each mail server prepends its own Received header, so line 1 is usually the hop closest to the recipient and the last line is closest to the sender. The tool does not reorder or time the hops.
How does the tool decide that SPF, DKIM or DMARC passed?
It searches the whole pasted text for spf=pass (or Received-SPF: pass), dkim=pass and dmarc=pass. A match anywhere, including in an ARC or forwarded header, counts as a pass; otherwise the hint says the pass was not clearly found. Read the Authentication-Results line yourself for fail, softfail or policy details.
Why is part of a header missing from the output?
Long headers are often folded onto several lines, with continuation lines starting with spaces. The analyzer shows only the first line of each From, Subject, Message-ID, Authentication-Results and Received header, so folded parts such as a Received timestamp after the semicolon can be cut off.
Is it safe to paste headers containing internal server names?
Yes. The analyzer runs entirely in your browser using JavaScript — no header data is transmitted to any server or third-party service. Internal hostnames, IP addresses, and message IDs stay on your device.
Can I trace the original sender's IP from the headers?
Often. The bottom-most (first) Received header typically contains the IP address of the original sending client or server; look for it in the last line of the listed Received chain. The tool does not extract or look up the IP for you, and some providers (e.g. Gmail) leave it out when the sender uses their webmail interface.

Explore the category

JSON to Rust Struct Generate Rust structs from JSON with serde rename hints. HTTP Headers Checker Inspect response status and headers from public HTTPS origins XML Sitemap Validator Parse pasted sitemap XML for structural issues. MX Record Lookup Look up a domain's MX records, sorted by priority, and see which known email provider runs its mail servers. Website Status Checker Check whether any website or URL is up or down and see its HTTP response code, response time, and server headers. HTTP Request Builder Send HTTP requests from your browser via a server-side proxy — set method, headers, body, and inspect the full response.
Understanding HTTP Headers: A Developer's Reference HTTP headers carry critical information about authentication, caching, content type, and security — yet many developers only interact with t Feb 2026 · 10 min How PGP Encryption Works: Keys, Trust, and Real-World Use PGP (and OpenPGP) has secured email and files since 1991. We explain key pairs, the web of trust, signing vs encrypting, and where PGP still Mar 2026 · 8 min

Glossary

SPF (Sender Policy Framework)
A DNS-based email authentication mechanism where the sending domain publishes a TXT record listing authorised mail server IP addresses. Receiving servers check the sending IP against this list and record the result in Authentication-Results headers.
DKIM (DomainKeys Identified Mail)
An authentication method that attaches a cryptographic signature to outgoing messages. The receiving server retrieves the public key from DNS and verifies the signature, confirming the message was not altered and was sent by an authorised server for the signing domain.
DMARC
Domain-based Message Authentication, Reporting, and Conformance — a policy layer built on top of SPF and DKIM. The sending domain publishes a DNS record specifying what receiving servers should do (none, quarantine, reject) when messages fail SPF or DKIM alignment.
Received Chain
The sequence of Received: headers added by each mail server that handled the message in transit. Reading the chain from bottom to top traces the delivery path from the original sender to the final recipient's inbox.
Envelope-From
The Return-Path address used by the SMTP protocol during message transmission — distinct from the visible From: header. SPF is checked against the envelope-from domain, not the From: header domain.
Authentication-Results
A header added by receiving mail servers recording the outcome of SPF, DKIM, and DMARC checks. Contains pass/fail verdicts and the relevant domains, making it the primary source for diagnosing email authentication issues.
A LITTLE HELP. A LOT DONE.
Good tools.
Great flow.

Your shortcut to the everyday. Create, convert, calculate,
and get back to what you love.

✓ Free to use✓ No sign-up✓ 500+ possibilities