UtilibyWritten by the Utiliby editorial team · Last updated October 15, 2026 · Rules and formulas reviewed October 2026
What this free online email header analyzer does
Every email carries a block of hidden text called the email headers. They record who sent the message, which servers handled it, when each step happened and whether the message passed security checks. When a message looks suspicious, arrives late or lands in spam, the headers hold the answer. They are also long and hard to read. This free online email header analyzer turns the raw text into a clear report: a verdict with findings, a timeline of the delivery path with the delay at every hop, the results of SPF, DKIM and DMARC, a check of the From, Return-Path and Reply-To addresses, and a searchable list of every header.
Use it to trace an email, to see why a message was delayed, to check whether an email could be spoofed or phishing, and to debug authentication on mail you send. It runs in your browser, so the headers never leave your device.
How to analyze email headers step by step
- Open the full headers in your mail program. The next section shows where to find them.
- Copy everything from the first header line to the last header line. You do not need the message body.
- Paste it into the box. The report appears at once.
- Read the verdict and findings. Problems are marked in red, things to check in amber and passes in green.
- Open Delivery path to see each hop and the wait between them.
- Open SPF, DKIM, DMARC to see the authentication results and whether the domains line up with the From address.
- Use All headers to search for a specific header.
Where to find the full headers in your email program
| Program | Steps |
|---|---|
| Gmail | Open the message, three dots, Show original, Copy to clipboard |
| Outlook desktop | Open the message in its own window, File, Properties, Internet headers |
| Outlook on the web | Three dots, View, View message details |
| Apple Mail | View, Message, All Headers or Raw Source |
| Yahoo Mail | Three dots, View raw message |
| Thunderbird | View, Headers, All, or View Source |
The headers that matter most
- From: the visible sender. It is easy to fake on its own.
- Return-Path: the address that receives bounces. It is set by the sending system and used in SPF checks.
- Reply-To: where your reply will go, if different from From.
- Received: one line per server, newest at the top. This is the delivery path.
- Authentication-Results: the SPF, DKIM and DMARC verdicts that your provider added.
- DKIM-Signature: the signature, including the signing domain (d=) and selector (s=).
- Message-ID: a unique identifier that real systems always add.
- Date: the time on the sender's clock.
- List-Unsubscribe: present on well-behaved bulk mail.
- X-Spam headers: scores and flags from spam filters, which vary by provider.
SPF, DKIM and DMARC in plain language
SPF lets a domain publish a list of servers that may send its mail. The receiving server compares the connecting IP with that list for the domain in the Return-Path. DKIM adds a digital signature that the receiver checks against a public key in DNS, which proves the message was not altered and that the signing domain approved it. DMARC ties them together. It asks that SPF or DKIM pass and that the passing domain line up with the visible From domain, and tells receivers what to do if not: nothing, quarantine or reject. A message can pass SPF and DKIM and still fail DMARC if the domains do not align, which is why the tool shows alignment. If you send email yourself, use the DMARC and SPF Record Generator to build the records.
Signs of a spoofed or phishing email
- SPF, DKIM or DMARC fails, or all three are missing.
- The display name shows one address but the real address is another.
- Return-Path or Reply-To uses an unrelated domain.
- The oldest hop is an unknown host or a home or mobile network instead of a mail server.
- The Date is far from the delivery time.
- The Message-ID is missing or uses a strange domain.
No single sign proves anything. Newsletters, ticketing systems and helpdesks often use different Return-Path and Reply-To domains. Treat the report as a prompt to look closer, never click links in a message you doubt, and report suspected phishing to your provider or IT team.
Why emails are delayed
The delivery path shows the time between each pair of timestamps. Most hops take under a few seconds. Long waits usually come from greylisting, where a receiver temporarily rejects unknown senders, from busy queues, from antivirus or data-loss scanning and from servers that are down and retrying. If every hop is quick but the message is still late, the sender may have scheduled it, or the Date header may be wrong. Negative delays mean two servers have clocks that differ, which is common and harmless.
If you send email: using headers to fix deliverability
Send a test message to a mailbox you control and paste its headers here. Check that SPF and DKIM pass and that both align with the From domain, because DMARC needs that. If the message reached spam, compare the headers with a message that reached the inbox. Content also matters, so run your copy through the Email Spam Word Checker, remove addresses that bounce with the Email Validator and List Cleaner and build your layout with the HTML Email Template Builder.
Privacy: what headers reveal
Headers can include your email address, the sender's IP address, internal server names, the programs used and sometimes the sender's location. Before you share headers with a support team, forum or friend, consider replacing addresses you want to keep private. This tool processes the text in your browser only.
Accuracy, limits and responsible use
The analyzer reads text. It cannot confirm that DNS records exist, check an IP address against a blocklist or know whether a header was forged. Results are rule-based and meant as a guide. Use it to understand your own mail and to spot warning signs, not as the only basis for accusing anyone or for a security decision.
Frequently asked questions
How do I use this free email header analyzer?
Copy the full headers of a message, paste them into the box and read the Summary. The Delivery path tab shows each hop and delay, and the SPF, DKIM, DMARC tab shows authentication results.
Is this email header analyzer really free?
Yes. It is a free online tool with no sign-up and no limits. The headers you paste stay in your browser.
How do I find the email headers in Gmail?
Open the message, click the three dots next to Reply, choose Show original and copy the text at the top, or use Copy to clipboard.
How do I find the headers in Outlook?
In desktop Outlook, open the message, choose File, Properties and copy the Internet headers box. In Outlook on the web, open the message, choose the three dots, View, View message details.
How do I find the headers in Apple Mail?
Open the message, choose View, Message, All Headers, or Raw Source, and copy the header lines.
How do I find the headers in Yahoo Mail?
Open the message, click the three dots, choose View raw message and copy the header block at the top.
What is a Received header?
Each mail server that handles a message adds a Received line that says where the message came from, which server got it, how and when. Together they form the delivery path.
In what order should I read Received headers?
From the bottom to the top. The bottom line is the first server that handled the message. This tool reorders them for you and numbers them from oldest to newest.
What do SPF, DKIM and DMARC results mean?
SPF checks that the sending server is allowed to send for the domain. DKIM checks a digital signature. DMARC says what to do when those checks do not line up with the visible From address. Pass is good, fail is a warning.
Why is Return-Path different from From?
Return-Path is where bounces go. Services that send mail for you often use their own domain there, so a difference is common, but it is also a sign spoofers look for.
What does a Reply-To mismatch mean?
If Reply-To points to a different domain than From, your reply goes somewhere else. That is a classic phishing sign, but some mailing tools use it on purpose.
How can I tell if an email is spoofed?
Look for failed SPF, DKIM or DMARC, a display name that hides another address, a Return-Path or Reply-To that does not match, and a delivery path that starts at an unexpected server. No single sign is proof.
Why did my email take so long to arrive?
The Delivery path tab shows the wait at each hop. Long gaps often mean a queue, greylisting, security scanning or a busy server, and the slow hop is where to look.
What is the originating IP?
It is the first public IP address found in the oldest Received line. Private addresses are skipped. It identifies the server that handed the mail to the first relay, not always the person who wrote it.
Can headers be faked?
Yes. A sender can write false lines at the bottom of the header block. The lines added by servers you trust, for example your own provider at the top, are the reliable ones.
Does this tool check IP reputation or DNS?
No. It works offline on the text you paste. To look at your own SPF and DMARC records you can build and check them with the DMARC and SPF Record Generator.
Can I save the analysis?
Yes. Copy the summary, download a text report or print or save a one-page report that shows only the findings and tables.
Sources and further reading
- IETF, RFC 5322: Internet Message Format.
- IETF, RFC 7208: Sender Policy Framework (SPF).
- IETF, RFC 6376: DomainKeys Identified Mail (DKIM) Signatures.
- IETF, RFC 7489: DMARC.
- Google, Trace an email with its full headers.
- Microsoft, View internet message headers in Outlook.
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.