Email Header Analyzer
Paste the raw headers of any email to see who really sent it, whether it passed SPF, DKIM and DMARC, and where it was delayed.
The analysis runs entirely in your browser. The headers you paste are never sent to our servers.
How to copy the headers of an email
Every mail client hides the headers by default. These are the menu paths in the most common ones:
- Gmail: Open the message, click the three-dot menu next to Reply and choose Show original. Copy everything above the message body.
- Outlook on the web: Open the message, click the three-dot menu, then View and View message source.
- Outlook for Windows: Double-click the message to open it in its own window, then File, Properties. The headers are in the Internet headers box.
- Apple Mail: Select the message, then View, Message, All Headers. On iPhone and iPad the headers are not available.
- Yahoo Mail: Open the message, click the three-dot menu and choose View raw message.
How to read the results
SPF, DKIM and DMARC
These three checks are recorded by the server that received the message, in the Authentication-Results header. SPF confirms the sending server is allowed to send for the domain. DKIM confirms the message was not altered after it was signed. DMARC ties both checks to the domain you see in the From line. Mail from a large bank, shop or social network normally passes all three. A fail on DMARC for a brand you recognise is a strong sign of spoofing.
The delivery route
Each server that handles a message adds a Received line at the top, so the oldest step is at the bottom. The analyzer reverses them into a timeline and works out the delay between steps from their timestamps. Clocks on different servers are not always in sync, so a small negative or odd delay usually means a clock is off, not that something is wrong.
Mismatched addresses
The From line is what you see, but Reply-To and Return-Path decide where replies and bounces go. Legitimate senders often use a different Return-Path, but a Reply-To on an unrelated domain means your answer goes to someone other than the apparent sender.
Why a temp mail service built this
We run the mail server behind PureTempMail, so we read headers every day to work out why a verification email arrived late or not at all. This tool is the same process, made available to anyone. It is also handy when testing your own sign-up emails with a temporary address: send the email, copy the headers and check that your domain passes authentication.