More
More
Email Header Analyser
Paste an email's headers to see where it really came from and whether it passed SPF, DKIM and DMARC.
Free tools that run in your browser. Nothing you type, open or create is uploaded to NerdBible or anyone else.
How to find the headers in your email app
- Gmail (web): open the message, press the three dots menu next to Reply, choose Show original, then Copy to clipboard.
- Outlook (web and new Outlook): open the message, press the three dots menu, then View and View message source (or View message details).
- Outlook (classic desktop): open the message in its own window, then File, Properties, and copy the Internet headers box.
- Apple Mail: open the message, then View, Message, All Headers (or Raw Source).
- Yahoo Mail: open the message, press the three dots menu, then View raw message.
The analysis is plain text parsing in your browser: nothing is looked up, and the headers are not sent anywhere. Only the lines added by your own email provider, the topmost Received and Authentication-Results lines, can be trusted. Anything further down was written by servers you do not control and can be forged by a sender.
How to use it
- Copy the full headers of the email from your email app (see the instructions above the box).
- Paste them into the box and press Analyse headers.
- Read the authentication results, any address mismatches and the route the email took, oldest server first.
Questions
What do SPF, DKIM and DMARC mean?
SPF checks that the sending server is allowed to send for the envelope sender's domain. DKIM checks a cryptographic signature added by the sending domain, which proves the signed parts were not changed. DMARC checks that the domain in the From address you see lines up with a domain that passed SPF or DKIM, and tells receivers what to do when it does not.
The email passed SPF and DKIM. Is it safe?
Not necessarily. A pass only proves the email came from the domain that signed it, and scammers own domains too. Check that the From domain is the real company's domain and that DMARC passed for it, and be careful with links and attachments either way.
Why do From and Return-Path differ?
Return-Path is where bounces go. Newsletters and mailing services often use their own domain for it, which is normal. A different Reply-To deserves more care: replies would go somewhere other than the address you see.
What do the delays between hops mean?
Each server stamps the time it received the email. A long gap points at the server that held the message, for example a spam filter or a queue. A negative delay usually means one server's clock is wrong.
Is my email sent anywhere?
No. The headers are read by JavaScript in this page on your device, and no lookups of IP addresses or domains are made.