Skip to content
myiphero

01 — Email tool

Email header analyzer

Paste the raw headers of a message to see who really sent it, whether SPF, DKIM and DMARC passed, and how long each server took. Parsed in your browser, never uploaded.

Parsed in
Your browser
Uploaded
Nothing
Reads
SPF · DKIM · DMARC · ARC · Received

Everything is parsed locally in this tab. Your headers are not sent anywhere, logged or stored. Not sure where to find them? See how to view headers.

Analysis

What it means

The verdict combines authentication results, sender mismatches and suspicious domains. The single most important line is DMARC: when it passes, the domain in the From address really authorised the message. When it fails for mail that claims to come from a bank, shop or colleague, treat the message as forged, however convincing it looks.

Sender alignment compares the addresses hidden in the headers with the one you see. A Reply-To on a different domain is the classic phishing setup: the message looks like it comes from the company, but your answer goes to the scammer. A different Return-Path is normal for newsletters and ticketing systems that send on a company’s behalf, as long as DKIM and DMARC pass.

The delivery path lists every server that handled the message, oldest first, with the time it spent at each step. Delays of a few seconds are normal; minutes point to queues or spam filtering; hours usually mean a server was retrying. The first public IP address in the chain is usually the sending server, and you can look up who operates it.

How it works

The analyzer unfolds the header block (long headers wrap onto indented lines), decodes encoded subjects and names, then reads Authentication-Results from your provider, Received-SPF, DKIM-Signature,ARC-Seal, the address headers and each Received line. Only the topmost Authentication-Results block is trusted, because anything below it could have been written by the sender.

How to view the full headers

Gmail
  1. Open the message.
  2. Click the three-dot menu ⋮ next to the reply arrow.
  3. Choose Show original. A new tab opens with the summary and the raw message.
  4. Click Copy to clipboard and paste everything above; the body is ignored automatically.
Outlook (new Outlook and Outlook on the web)
  1. Open the message.
  2. Click the three-dot menu … at the top right of the message.
  3. Choose View → View message source (or View message details).
  4. Select all text in the window (Ctrl/Cmd + A), copy and paste it here.
Outlook for Windows (classic)
  1. Double-click the message to open it in its own window.
  2. Go to File → Properties.
  3. Copy everything from the Internet headers box at the bottom.
Apple Mail (Mac, iPhone, iPad)
  1. On a Mac, select the message and choose View → Message → All Headers (Shift + Cmd + H), or Raw Source (Option + Cmd + U).
  2. Copy the header lines and paste them here.
  3. The Mail app on iPhone and iPad cannot show headers. Open the message in your provider’s webmail on a computer instead.
Yahoo Mail and Thunderbird
  1. Yahoo: open the message, click … (More) → View raw message.
  2. Thunderbird: open the message and press Ctrl/Cmd + U (View → Message Source).

Pasting the whole message source is fine: parsing stops at the first blank line, where the headers end and the body begins. Checking an address before you write back? Try the email checker.

Frequently asked questions

What are email headers?

Every message carries a block of technical lines above the text you read: who it claims to be from, where replies go, which servers handled it and when, and what the receiving server concluded about its authenticity. Mail apps hide them, but you can always display the “original” or “source” of a message.

Is it safe to paste my headers here?

Yes. The analysis is plain JavaScript running in your browser tab; the headers are never uploaded, logged or stored. You can disconnect from the internet after the page has loaded and it still works. Headers can contain your address and internal server names, so avoid pasting them into tools that send them to a server.

What do SPF, DKIM and DMARC “pass” and “fail” mean?

SPF checks whether the server that delivered the message may send for the envelope domain. DKIM checks a cryptographic signature added by the sending domain. DMARC ties them to the From address you see: it passes only if SPF or DKIM passed for a matching domain. A DMARC fail on mail “from” a bank or big brand is a strong sign of forgery.

Can email headers be faked?

Partly. A sender can write anything into From, Reply-To, Subject and even add fake Received lines below the real ones. What they cannot fake are the lines added by servers after the message left their control, which is why we trust only the topmost Authentication-Results from your own provider and read the Received chain from the top down.

How do I find the sender’s IP address?

Read the Received lines from the bottom up. The first hop with a public IP address is usually the server or device that submitted the message. Big providers like Gmail often hide the sender’s home IP and show their own outgoing server instead. We mark the most likely origin and link each public IP to the IP lookup tool.

Why was my email delayed?

Look at the delays between hops in the timeline. A long gap at one server usually means queueing, greylisting (a deliberate delay against spam) or a temporarily unreachable server. Small negative delays are just clocks that disagree by a few seconds.

Related tools

Learn