Free tool · Writing and email
Email header analyzer
Paste the headers of any email to see every server it passed through, how long each hop took and whether SPF, DKIM and DMARC passed.
Runs in your browser. Nothing you paste is uploaded.
About this tool
Email header analyzer: how it works
We built this for our own support inbox. When a customer says "your email went to spam" or "I never got the reset link", the headers have the answer, but they are hard to read raw: folded lines, newest server first, and timestamps in three time zones.
The analyzer unfolds the headers, puts the Received hops in the order the email actually travelled and works out the delay at each step, so a 40 minute greylisting delay jumps out. It reads Authentication-Results for SPF, DKIM and DMARC, decodes =?UTF-8?...?= subjects and names, and warns when the Reply-To or Return-Path points somewhere other than the From domain, which is how most phishing looks.
Everything runs in your browser and nothing is uploaded. Public server IPs link to the IP lookup so you can see who runs them. If you are setting up support email, see how to forward your inbox to Ticketdesk.
What it does
- SPF, DKIM and DMARC results at a glance
- Delivery path with the delay at each hop
- Warnings for Reply-To and Return-Path mismatches
- Decodes encoded subjects and names (RFC 2047)
- Searchable list of every header
- Open .eml files, copy JSON, download a report
Building on Ticketdesk?
Automate tickets, AI agents and inboxes from your own code.
FAQ
Email header analyzer: common questions
How do I view email headers in Gmail?
Open the email, select the three dots next to Reply, then Show original. Select Copy to clipboard and paste here. Gmail calls this the original message, and it includes the full headers.
How do I get email headers in Outlook?
In Outlook on the web, open the email, select the three dots, then View and View message details. In the desktop app, open the email in its own window and go to File, then Properties, and copy the Internet headers box. This tool works as an alternative to Microsoft Message Header Analyzer.
What do SPF, DKIM and DMARC results mean?
SPF checks that the sending server is allowed to send for the domain. DKIM checks a signature that proves the message was not changed. DMARC checks that the visible From domain lines up with SPF or DKIM. A pass on DMARC is what matters most. A fail usually means spoofing or a misconfigured sender.
Why was my email delayed?
Look at the delay column in the delivery path. A long delay before one server usually means greylisting, a full queue or a spam filter holding the message. Hops are ordered from the sender to your inbox.
How can I tell if an email is phishing?
Red flags are a DMARC fail, a Reply-To on a different domain than the From address, and a first hop from an unexpected network. The analyzer warns about the first two. Check the first public IP with the IP lookup.
Is it safe to paste email headers here?
Yes. Parsing happens in your browser and the headers are never sent to a server.