📧
Email Header Analyzer
Find out if an email really came from who it claims, and where delays happened.
How to get the headers
- Gmail: open the email → ⋮ → Show original.
- Outlook (web): ⋯ → View → View message source.
- Outlook (desktop): File → Properties → Internet headers.
Reading the results
- SPF checks the sending server is allowed to send for the domain.
- DKIM checks the message was signed by the domain and not altered.
- DMARC checks SPF or DKIM passed for the domain in the From address.
- Hops show each server in order, with delays taken from their timestamps.
A DMARC fail on an email claiming to be from a bank or government office is a strong sign of phishing.
Frequently asked questions
Is this private?
Yes. Headers are analysed in your browser and never sent anywhere.
Why is DKIM 'not found'?
Your mail provider didn't record a DKIM result, or the header was cut off. Paste the full header.
Can this tell who sent the email?
It shows the servers involved, not the person. Addresses in headers can also be forged except where your own provider added them.