Email Headers Analyzer
Parse and analyze email headers to trace delivery path and debug issues.
Email Header Analyzer — Trace Delivery Path & Debug Issues
Email header analysis parses Received, Authentication-Results, DKIM-Signature, and Return-Path headers to trace how an email traveled from sender to recipient and verify authentication results.
Every email carries headers that record its journey through mail servers. The Received headers form a chain from origin to destination with timestamps. Authentication-Results headers show SPF, DKIM, and DMARC verdicts. Our analyzer parses all these into a readable format, showing delivery path, authentication status, and timing.
What are Email Headers?
Email headers are metadata lines prepended to every email recording the sender, recipients, routing path, timestamps, and authentication results. Invisible in email clients but essential for debugging deliverability.
When you receive an email, your mail client shows the friendly view. But the raw email contains dozens of header fields added by each server that processed the message — the true origin IP, every server in transit, queue wait times, and SPF/DKIM/DMARC results. Headers are the primary tool for diagnosing spoofing, phishing, and delivery delays.
How to Trace Email Delivery Path from Headers
The delivery path is in Received: headers, read bottom-to-top. Each hop adds a Received header showing the sending server, receiving server, and timestamp. Large gaps between timestamps indicate delays.
To trace the delivery path: (1) Find all Received: headers. (2) Read bottom-to-top — the bottom-most is the origin, top-most is the final destination. (3) Each shows 'Received: from [sending server] by [receiving server]; [timestamp]'. Large delays between hops indicate queuing problems or spam filtering.
Reading SPF, DKIM, and DMARC from Email Headers
The Authentication-Results header shows SPF, DKIM, and DMARC verdicts. 'spf=pass', 'dkim=pass', 'dmarc=pass' means fully authenticated email. Any fail indicates potential spoofing or misconfiguration.
Authentication-Results is added by the receiving server and contains results like 'spf=pass', 'dkim=pass header.d=example.com', and 'dmarc=pass'. If SPF fails, check the Return-Path domain against authorized senders in DNS. If DKIM fails, the signature may have been modified in transit or the key may have been rotated.
Paste your email headers to analyze delivery path, hop timing, and authentication results instantly.
Analyze email headers nowUse Cases
IT administrators investigate reported phishing emails and trace the true sender. Email deliverability engineers diagnose why legitimate email lands in spam. Security teams correlate IP addresses in Received headers with threat intelligence feeds. Users verify that a suspicious email actually came from who it claims.
How to Get Email Headers
Gmail: Settings → More options → Show original. Outlook: File → Properties. Apple Mail: View → Message → All Headers.