Home
Free email tools
Email header analyzer

Free tool · Runs in your browser

Free Email Header Analyzer

Paste an email’s headers to see the route it took, how long each step took, what SPF, DKIM and DMARC reported, and what deserves a closer look.

The header analyzer needs JavaScript, because it reads your headers inside your browser. You can still read how to analyze headers below.

How it works

How to analyze email headers

Three steps, about a minute. You need the full header text of the message, and every email app can show it.

Copy the full headers
In your email app, open the message and choose the option that shows the original message or its headers. Copy everything from the first line down to the first blank line. See the steps for your app.
Paste and analyze
Paste the text into the box at the top of this page and click Analyze headers. If you paste the whole message, only the headers are read and the body is ignored. Nothing leaves your browser.
Read the report
Start with Worth a look, then check the reported SPF, DKIM and DMARC results and the delivery route. Before sending headers to anyone, use Copy or download report to hide addresses and IPs.

Example with sample headers.

Step 1 in detail

How to view email headers in Gmail, Outlook and other apps

Look for “Show original”, “View message details”, “View source” or “Raw message”. Most phone apps can’t show headers, so use a computer when you can.

Gmail

In a web browser

Open the email in Gmail on the web.
Next to Reply, click More (⋮).
Click Show original. The headers open in a new tab.
Click Copy to clipboard and paste here.

The Gmail app for Android and iPhone can’t show full headers.

New Outlook and Outlook.com

Web and new Outlook for Windows

Open the email.
Click More actions (…) at the top of the message.
Choose View, then View message details.
Select all the text in the window and copy it.

Works the same in Outlook on the web.

Classic Outlook

Desktop app for Windows

Double-click the email so it opens in its own window.
Click File, then Properties.
Click in the Internet headers box, press Ctrl+A, then Ctrl+C.

Mail sent inside one Microsoft 365 organization may have only a few header lines.

Apple Mail

Mail app on Mac

Select the email.
In the menu bar, choose View › Message › All Headers.
Select the header lines above the message text and copy them.

View › Message › Raw Source also works and shows the complete original.

Yahoo Mail and AOL

In a web browser

Open the email in Yahoo Mail on the web.
Click More (…) in the toolbar.
Choose View raw message and copy the text from the new tab.

In AOL Mail, the option is called View Message Source.

Thunderbird

Windows, Mac and Linux

Select the email.
Choose View › Message Source, or press Ctrl+U (⌘+U on Mac).
Copy the text from the window that opens.

To show more headers in the reading pane, use View › Headers › All.

Paste your headers into the analyzer ↑

The basics

What is an email header?

It’s the block of technical lines at the top of every message. Your email app shows only From, To, Subject and Date, but the full header records every server that handled the message and what each one concluded.

The delivery route

Each server that passes the message on adds a Received line, so together they show the path from the sender to your inbox.

Received

Delays at each hop

Every Received line has a timestamp. Comparing them shows where a message waited, even across time zones.

Timing

SPF, DKIM and DMARC results

The receiving server writes down whether the message passed sender authentication, and who checked it.

Authentication-Results

Who it’s really from

The display name can say anything. The address, reply address and bounce address tell you more.

From · Reply-To · Return-Path

Spam filter verdicts

Microsoft 365, SpamAssassin and other filters leave scores and codes such as SCL, BCL, SFV and CAT.

X-Forefront-Antispam-Report

Everything else

Message IDs, unsubscribe links, the app that sent it and the X- lines your mail system added along the way.

All other fields

Reference

Email header fields explained

The fields you’ll see most often. Some are written by the sender and some by servers along the way, which matters when you decide how far to trust them.

Sender and recipients

Field	What it tells you	Written by
From	The sender shown in your inbox: a display name and an address. Easy to fake on its own, which is why SPF, DKIM and DMARC exist.	Sender
Reply-To	Where replies go, if different from From. Common in newsletters, and also in invoice scams.	Sender
Return-Path	The envelope sender, where bounces go. SPF is checked against this domain.	Receiving server
To, Cc, Delivered-To	The listed recipients, and the mailbox the message was actually delivered to.	Sender, receiver
Date	When the sender’s app says the message was written. It comes from the sender’s clock, so it can be wrong.	Sender
Subject	The subject line. Non-English text is often encoded (=?UTF-8?…?=), and the analyzer decodes it.	Sender
Message-ID	A unique ID for the message, usually ending in the sending system’s domain. Useful when asking a provider to trace a message.	Sender’s system

Route and authentication

Field	What it tells you	Written by
Received	One line per server hop: who handed the message over, who took it, the protocol, often TLS details, and a timestamp. The newest is at the top.	Each server
Authentication-Results	The receiving server’s verdict on SPF, DKIM, DMARC and sometimes ARC (RFC 8601). The one your own provider added is the one to trust.	Receiving server
Received-SPF	An older, SPF-only result line, including the sending IP that was checked.	Receiving server
DKIM-Signature	The cryptographic signature. `d=` is the signing domain and `s=` the selector used to look up its key.	Sending system
ARC-Seal, ARC-Authentication-Results	Added by forwarders and mailing lists to record the authentication results they saw before changing the message (RFC 8617).	Intermediaries

Lists and spam filters

Field	What it tells you	Written by
List-Unsubscribe, List-Unsubscribe-Post	The unsubscribe link and email. `List-Unsubscribe=One-Click` means one-click unsubscribe, which Gmail and Yahoo require from bulk senders.	Sender
X-Forefront-Antispam-Report	Microsoft 365’s filter report: SCL (spam confidence), SFV (verdict), CAT (threat category), CIP (connecting IP) and more.	Microsoft
X-Microsoft-Antispam	Includes BCL, the bulk complaint level from 0 to 9. Higher means the sender’s bulk mail draws more complaints.	Microsoft
X-Spam-Status, X-Spam-Score	Verdicts and scores from SpamAssassin and similar filters.	Receiving filter
X-Originating-IP	Some webmail services record the IP of the device that sent the message. Many providers no longer add it, for privacy.	Sender’s provider

Authentication

Understanding SPF, DKIM, DMARC and Authentication-Results

When your provider receives a message, it checks the sender’s DNS records and writes the outcome into an Authentication-Results header. Here’s how to read one.

Example

Authentication-Results: mx.inbox.example;
    spf=pass smtp.mailfrom=bounce@mail.esp.example;
    dkim=pass header.d=shop.example header.s=s2026;
    dmarc=pass (p=QUARANTINE) header.from=shop.example

SPFWas the server that delivered the message allowed to send for the envelope domain (smtp.mailfrom)? It often breaks when mail is forwarded.
DKIMDid a signature from the domain in header.d verify, proving the signed parts weren’t changed in transit?
DMARCDid SPF or DKIM pass for a domain that matches the visible From address (header.from)? This ties authentication to the sender you see.

Reading the result

The first word after the header name (mx.inbox.example) is the server that did the check. Trust results from your own provider.
pass means the check succeeded. fail, softfail and permerror mean it didn’t. none means the sender publishes no record.
DMARC needs only one of SPF or DKIM to pass and align. SPF failing while DMARC passes is normal for forwarded mail.
compauth appears in Microsoft 365 mail. It’s Microsoft’s combined verdict, with a reason code the analyzer explains.

What a result doesn’t prove

It’s a record, not a re-check. The analyzer reads what the server wrote. Lines added before your provider received the message can be forged.
A pass proves the domain, not the person. Scammers register lookalike domains and pass SPF, DKIM and DMARC for them.
Records change over time. To see a domain’s records today, use the Email Domain Checker.

Routing

How to read Received headers and trace an email’s route

Each server adds its Received line at the top, so the newest hop comes first. To follow the message from the sender to you, read them from the bottom up.

Example

Received: from out-24.mail.esp.example
        (out-24.mail.esp.example [198.51.100.24])
        by mx.inbox.example with ESMTPS id 5b1f17b18
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384);
        Mon, 2 Nov 2026 01:14:08 -0800

from … by …The server that handed the message over, with the IP the receiver actually saw in brackets, and the server that accepted it.
with ESMTPSThe protocol. An S means the hop used TLS encryption and an A means the sender logged in. One encrypted hop doesn’t mean every hop was.
The date after “;”When this server received the message. The analyzer converts time zones and subtracts the previous hop to show the delay.

Find your provider’s lines
The topmost Received lines come from your own provider and are the most trustworthy. Everything below was written by servers outside its control.
Look for the long wait
A delay of minutes or hours at one hop points to greylisting, retries or a busy server. Times that go backwards usually mean a server clock is wrong.
Treat the first IP with care
The earliest public IP is usually the sender’s mail server or provider, not their computer. Providers like Gmail don’t include the sender’s own IP at all.

Phishing

Can email headers reveal a fake sender?

Often, but not always. These are the header signs worth checking. Each has innocent explanations too, so judge them together with the message itself.

From

A name that hides the address

The display name says “PayPal Support” or even shows a real-looking address, but the actual From address is something else.

Check

Compare the name with the address in angle brackets. The analyzer flags names that contain a different address.

Reply-To

Replies go somewhere else

The From address looks right, but Reply-To sends your answer to a different domain, often a free mailbox.

Check

Before replying with payment details or documents, confirm the Reply-To domain belongs to the sender.

DMARC

DMARC failed

Your provider reported dmarc=fail: the message couldn’t prove it came from the domain in From.

Check

Be careful with links and attachments unless you expected the message. Real senders sometimes fail after forwarding.

Domain

A lookalike domain

paypa1.com, micros0ft-support.com, or a name using letters from another alphabet (shown as xn-- in headers).

Check

Read the domain letter by letter. A domain can pass every check and still be a fake.

Structure

Duplicated or conflicting fields

Two From fields, or two Authentication-Results headers that disagree. Different apps may show different values.

Check

Trust the authentication report your own provider added, normally the topmost one.

Received

A route that doesn’t add up

Times that go backwards, or a Date long after the first server timestamp.

Check

Usually a wrong clock. Occasionally the lower part of the route was invented to look legitimate.

Limits

What headers can’t tell you

Honest limits, so you don’t read more into a report than it contains.

Who typed it
Headers identify domains and servers, not the person at the keyboard.
Where the sender is
An IP usually belongs to a mail provider or data center, not the sender’s location.
Whether lines were added
Anything written before your provider received the message can be made up.
That a message is safe
A clean report means no common warning signs, not that links or attachments are harmless.

FAQ

Email header analyzer FAQ

What does an email header analyzer do?

It turns the raw header text of an email into a readable report: the servers the message passed through and the delay at each, the SPF, DKIM and DMARC results the receiving server recorded, who the message claims to be from and where replies go, spam filter verdicts, and anything unusual worth a closer look.

Is it safe to paste my email headers here?

The analyzer runs entirely in your browser. The headers you paste aren’t uploaded, saved or sent to analytics, and they disappear when you close the page. Headers do contain email addresses, IP addresses and message IDs, so use the redaction options before you share a report with anyone.

Can email headers be faked?

Partly. The sender controls fields like From, Reply-To, Date and Subject, and can add made-up Received lines below the real ones. What they can’t easily fake are the lines your own provider adds when it receives the message, including its Authentication-Results. That’s why the analyzer separates what was reported from what is proven.

Can I find the sender’s IP address or location from the header?

Sometimes you can find the IP of the server that sent the message: it’s in the earliest Received line with a public address. That’s usually the sender’s email provider, not their device, and big providers like Gmail and Outlook.com don’t include the user’s own IP. IP location shows where a server is registered, which says little about where a person is. This tool doesn’t look up IP locations.

Why does SPF fail but DMARC pass?

DMARC passes when either SPF or DKIM passes for a domain that matches the From address. When a message is forwarded, the forwarding server isn’t in the original sender’s SPF record, so SPF fails, but the DKIM signature usually survives and DMARC still passes.

Why are there so many Received headers?

Every server that handles the message adds one: the sender’s app, the sending provider’s internal systems and outbound servers, then your provider’s gateway, filters and mailbox servers. Five to ten is normal for mail from a large service.

What do SCL and BCL mean in Microsoft headers?

SCL is Microsoft’s spam confidence level: −1 means filtering was bypassed, 0 and 1 mean not spam, 5 and 6 mean spam, and 7 to 9 mean high-confidence spam. BCL, the bulk complaint level, runs from 0 (not bulk) to 9 (bulk mail with many complaints). Microsoft says SFV and CAT are the better signals for cloud mailboxes, and the analyzer explains those too.

How do I view email headers on my phone?

Most phone apps, including the Gmail and Outlook apps, don’t show full headers. Open your webmail in a browser, preferably on a computer, and follow the steps for Gmail, Outlook or Yahoo on this page.

What’s the difference between From and Return-Path?

From is the sender you see. Return-Path is the envelope sender, where bounces go. They often differ when a company sends through a mailing service. SPF checks the Return-Path domain, and DMARC checks that it, or the DKIM domain, matches From.

Atomic Mail

Private email with phishing protection built in

Atomic Mail encrypts your mail end to end, filters spam and phishing, and lets you hide your real address behind aliases. It’s free to start, and you don’t need a phone number to sign up.

Create a free account Check a domain’s email setup

Try the most secure email now for free!

Atomic Mail

Private, end-to-end encrypted email. No phone number needed.

support@atomicmail.io

AtomicMail Systems OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Harju tn 3 // Vana-Posti tn 2, 10146

Free Email Header Analyzer

How to analyze email headers

Copy the full headers

Paste and analyze

Read the report

The delivery route

Delays at each hop

SPF, DKIM and DMARC results

Who it’s really from

Spam filter verdicts

Everything else

Sender and recipients

Route and authentication

Lists and spam filters

Reading the result

What a result doesn’t prove

Find your provider’s lines

Look for the long wait

Treat the first IP with care

A name that hides the address

Replies go somewhere else

DMARC failed

A lookalike domain

Duplicated or conflicting fields

A route that doesn’t add up

Who typed it

Where the sender is

Whether lines were added

That a message is safe

Private email with phishing protection built in