Email Header Analyzer: Trace Where an Email Came From

By Debmedia Technologies LLP · Kolkata, India · Updated 3 November 2026

What Is an Email Header Analyzer?

An email header analyzer reads the hidden technical headers of a message and shows the path it took from the sender to you. Every server that handles an email adds a Received line, so the headers form a trail. They also carry the results of the SPF, DKIM and DMARC checks that prove whether the sender is genuine.

This email header analyzer turns the wall of text into a clear table of hops and a list of checks. Use it to investigate spam, phishing, delivery delays or a message that looks suspicious.

How to Use This Email Header Analyzer

Open the message and copy its full headers. In Gmail choose Show original, and in Outlook open the message properties.
Paste the text into the box above.
Press Analyze headers.
Read the checks first, then the route table and the key headers.

What the Analysis Shows

Section	What it tells you
Authentication checks	Whether SPF, DKIM and DMARC passed, failed or were missing.
Consistency checks	Warnings when From, Return-Path and Reply-To use different domains.
Route table	Each server the message passed, with its address, protocol, time and delay.
Key headers	From, To, Subject, Date, Message-ID and other important fields.

The message format itself is described in RFC 5322, the email message format.

Warning Signs in Headers

SPF or DKIM fails. The server that sent the mail was not allowed to, or the message was altered.
DMARC fails. The visible From address does not line up with the authenticated domain, a classic sign of spoofing.
Different Reply-To domain. Replies would go somewhere other than the shown sender.
Long delays. Gaps of many minutes between hops suggest queues or greylisting.
Unexpected origin. An address from a country or provider that does not match the claimed sender.

How Much to Trust the Headers

A sender can invent any header at the start of the chain. Only the lines added by servers you trust, such as your own mail provider, are reliable. Read the route from the bottom up and rely most on the hops closest to you.

Investigate Further

Look up the public addresses in the route with the IP owner lookup, find their hostnames with the reverse DNS tool and check the sending domain with the domain address finder. Your headers are analysed in your browser and never uploaded.

Tips for Better Results

Paste the complete headers, not only the first lines. Missing lines can hide authentication results.

Frequently Asked Questions

How do I get the full headers of an email?+

In Gmail open the message, choose the three-dot menu and pick Show original. In Outlook open Properties or View message source. Copy everything above the message body.

In which order should I read the Received lines?+

Each server adds a Received line at the top, so the newest hop is first in the raw text. The tool reverses them, so hop 1 is the one closest to the sender.

Can headers prove an email is fake?+

They give strong clues. Failed SPF, DKIM and DMARC checks and a mismatch between From and Return-Path are warning signs, but only the first hops added by your own provider can be fully trusted.

Is it safe to paste my headers?+

Yes. The analysis runs in your browser and nothing is sent to our server. Headers can contain addresses, so avoid sharing them publicly.

Disclaimer: results come from live requests and can change as records and servers change. We cannot guarantee that every answer matches what every visitor sees.