Email header analyzer
Every email carries hidden headers that record where it came from and whether it passed security checks. Paste them here to read them in plain English.
How to copy the full headers
- Gmail (computer): open the email, click the three dots next to Reply, choose Show original, then Copy to clipboard.
- Outlook on the web and new Outlook: open the email, click the three dots, choose View, then View message details, and copy everything.
- Classic Outlook for Windows: open the email in its own window, choose File, then Properties, and copy the Internet headers box.
- Apple Mail: open the email, choose View, then Message, then All Headers (or Raw Source).
- Yahoo Mail: open the email, click the three dots, choose View raw message.
What the analyzer shows
| Part | What it tells you |
|---|---|
| From, Reply-To, Return-Path | Who the email says it is from, where replies go, and where bounces go. When these point to unrelated domains, look closer. |
| SPF, DKIM, DMARC | Whether the email passed the sender domain's security checks, as recorded by your provider |
| Route | Each server the email passed through, in order, with the delay at each step |
| Warning signs | Failed DMARC, replies redirected to another domain, and a display name that shows a different address |
Which headers can you trust?
Headers are added from the bottom up as an email travels. The ones near the top were added by your own provider and can be trusted. Anything lower down, and the From line itself, can be written by whoever sent the message. That is why the SPF, DKIM and DMARC results added by your provider matter more than what the email claims about itself.
Questions people ask
- Can an email header be faked?
- Partly. A sender can write any From address and add fake lines at the bottom of the headers. They can't fake the lines your own provider adds at the top, including the SPF, DKIM and DMARC results.
- Can I find the sender's IP address?
- Often, yes: it's in the first Received line added by your provider. But big providers like Gmail and Outlook.com hide the sender's home IP address, so you usually only see their server.
- Is it safe to paste headers here?
- Yes. The analyzer runs entirely in your browser and nothing is sent anywhere. Headers can contain your email address, so don't paste them into tools you don't trust.