Email Header Analyzer

Read a message's route and its authentication — including whether it aligns.

What you paste

Parsed in your browser — never uploaded

Full message headers

How this reads your output

Headers answer two different questions and this reads both. For delay, the Received chain is reversed — each server prepends its own line, so the raw headers read newest first and the message actually travelled in the opposite order — and the gap between consecutive timestamps shows where time went. For authenticity, the results your provider recorded are read, and then the part that matters: whether SPF or DKIM authenticated the same domain as the visible From address. A message can pass SPF perfectly for a domain the sender controls while claiming to be from your bank, and alignment is the check that catches it.

What the results mean

Alignment: Whether the authenticated domain matches the visible sender. A pass for a different domain is the mechanism behind most convincing phishing.
SPF: Whether the sending server was authorised by the domain it claimed. Breaks legitimately when mail is forwarded.
DKIM: A signature over the message. Survives forwarding, and breaks when a mailing list rewrites the message.
Slowest hop: The largest gap between consecutive servers. A long one is usually greylisting — a deliberate delay of a first message from an unknown sender — or a queue.
Return-Path: Where bounces go. Different from the From address for legitimate bulk mail, and also a phishing signature — context decides which.

Common problems and fixes

SPF failed but the message is genuine: Forwarding breaks SPF by design: the forwarding server is not authorised by the original domain. DKIM survives forwarding, which is why DMARC accepts either.
The message took hours to arrive: Look for the largest gap. A single long delay at one hop is usually greylisting, which resolves on the retry. Delays spread across every hop point at a queue somewhere.
My client will not show headers: Every client hides them by default. Look for "show original", "view source" or "message details" — and paste everything above the message body.

Frequently asked questions

How do I tell if an email is really from who it says?

Check alignment rather than the pass. SPF and DKIM can both pass for a domain the sender legitimately controls while the visible From address says something else entirely — which is exactly how a convincing phishing message is built. DMARC is the check that requires the authenticated domain to match the visible one, and a DMARC failure on a message claiming to be from a bank is the finding.

Why did my email take so long to arrive?

Find the largest gap between consecutive Received lines. A single delay of a few minutes to an hour at one hop is usually greylisting, a deliberate deferral of a first message from an unknown sender that resolves on the retry. Delays spread evenly point at a queue rather than a policy.

Can email headers be faked?

Everything above the first server you trust can be. A sender writes their own headers, so the useful part is what your own provider added — the authentication results — rather than the route the message claims to have taken.

Put this on your own site

Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.

Embed code

<iframe src="https://runthetests.com/embed/email-header-analyzer/" width="100%" height="720" style="border:1px solid #e5e5e5;border-radius:8px" title="Email Header Analyzer" loading="lazy"></iframe>

Preview it at https://runthetests.com/embed/email-header-analyzer/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.