Email Header Analyzer
Is this email really from who it claims to be?
Paste a raw email header to trace its routing path, find the real sender IP, check SPF / DKIM / DMARC authentication, and spot spoofing signs — in seconds.
How to get the raw header
Choose your email client for copy-paste steps, or paste a header you already have.
1. Choose your email client
Open the email, click the ⋮ (More) menu in the top-right, choose “Show original”, then copy the full text.
2. Paste the header into the analyzer
3. Read the verdict: authentication results + spoofing indicators
100% private — headers are parsed locally in your browser and never uploaded.
How to Check If an Email Is Fake: 3 Steps
Step 1 — Copy the raw header from your email client
In Gmail open the email and click ⋮ → Show original. In Outlook on the web click ⋯ → View → View message source. The raw header is a block of technical lines at the top of the message source — copy that whole block.
Step 2 — Paste the header and let the analyzer decode it
Paste the copied header into the parser above. It decodes the From and Reply-To addresses, the full Received routing chain with each hop’s IP and delay, the ultimate source IP, and the SPF / DKIM / DMARC authentication results.
Step 3 — Read the verdict and act
If authentication shows pass and addresses match, the message most likely really comes from the claimed domain. If you see SPF or DKIM fail, mismatched Reply-To / Return-Path, or a suspicious source IP — do not reply and do not click links. Test any link with the link checker first.
Email Header Analyzer FAQ
What is an email header analyzer?
A: An email header analyzer decodes the raw metadata that every email carries — routing path, sending server, and authentication results — and turns it into a human-readable report. It helps you verify who really sent a message and spot forged or phishing emails.
How do I view email headers in Gmail or Outlook?
A: In Gmail, open the email, click the three-dot menu (⋮) at the top right and choose “Show original”. In Outlook on the web, open the email, click ⋯ → View → View message source. Copy the full raw header text and paste it into this analyzer.
What are SPF, DKIM and DMARC?
A: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC are the three email authentication standards. SPF verifies the sending server is authorized by the domain, DKIM verifies the message was signed and unchanged in transit, and DMARC tells receivers what to do when SPF or DKIM fails. Together they make sender-address spoofing much harder.
How can I tell if an email is spoofed?
A: Look for three signs: authentication results showing SPF or DKIM “fail”, a Reply-To or Return-Path address that differs from the From domain, and a routing (Received) chain that does not match the claimed sender. This analyzer checks all three automatically and lists any risk indicators.
What does “SPF fail” mean?
A: SPF fail means the email was not sent from a server authorized by the domain’s SPF record. It is a strong signal the message may be forged — but not conclusive alone, because some legitimate senders misconfigure SPF. Combine it with the DKIM and DMARC results for a confident verdict.
Why should I check email headers at all?
A: Phishing depends on forged sender addresses, and email headers are the only place to see the true routing and authentication data behind a message. The APWG recorded 971,181 phishing attacks in Q1 2026 alone, and Verizon's 2026 Data Breach Investigations Report finds phishing is the entry vector in 16% of breaches — with human error and social engineering involved in 62%. Business email compromise attempts average $61,732 per request. Checking a suspicious header takes a minute and can prevent credential theft, malware, or invoice fraud.
Is my email header data private?
A: Yes. Any header you paste is parsed locally in your browser using JavaScript — nothing is uploaded. This tool makes no network request with your header content, so a sensitive internal email header stays on your device.
What is the Received chain in an email header?
A: The Received chain is a list of “Received:” lines added by each mail server the message passed through. Read from the bottom, it shows the route from the original sender to you, and the last Received line typically reveals the ultimate source IP of the message.