Email Header Analyzer

How to use it

1. Open the original message in your mail client and copy its full headers, then paste them into the box.
2. The summary table fills in as you type: From, To, Cc, Subject, Date, Message-ID, Return-Path and List-Unsubscribe when present.
3. The Received table lists every hop from oldest to newest, with the from, by, protocol and the timestamp after the last semicolon.
4. The authentication card shows the DKIM, SPF and DMARC results exactly as the handling servers wrote them, plus any DKIM-Signature domain and selector.
5. Copy the report to attach it to a phishing investigation or a delivery complaint.

Common use cases

• Phishing triage - see which servers a suspicious message really passed through.
• Delivery debugging - find where a message stalled by reading the hop order and timestamps.
• DMARC checks - confirm whether dkim, spf and dmarc passed for a newsletter you publish.
• Header archiving - turn a wall of folded text into a readable summary for a ticket.

Why it stays private

All parsing happens in this tab on the text you paste. The tool makes no DNS queries and no network requests, so authentication results are shown as written and never re-verified here.

FAQ

Q: Why are the Received hops sorted by date? A: Every server prepends its own Received line as the message travels. The parser reads the date after the last semicolon and sorts oldest first. Server clocks can drift, so the order is approximate rather than proof.

Q: Does a DKIM pass mean the message is safe? A: No. DKIM shows that parts of the message were signed by the claimed domain, and spammers sign their mail too. SPF and DMARC describe the sending domain, not the intent of the sender.

Q: Are encoded subjects decoded? A: Words like =?UTF-8?Q?...?= and =?UTF-8?B?...?= are decoded, assuming UTF-8 for less common charsets.

Q: Does the tool verify SPF by querying DNS? A: No. Nothing leaves the tab. The Received-SPF and Authentication-Results values are reproduced as text, not re-computed.