IT Buddy
Menu
NetworkingSecurityCloudLinux & DevOpsUtilitiesMicrosoft Soon
All toolsMy toolsWhat's newAbout

Email header analyzer

Paste email headers to see the delivery path, SPF, DKIM and DMARC results, and spot spoofing signs like a mismatched From domain.

Runs in your browser · nothing is sentEmail securityNew

Paste the full headers of a message (everything from Received: or From: down to the first blank line). Nothing you paste here is sent anywhere.

Nothing you paste here is logged or sent.

How to use

  1. Open the message in your mail client and show the original headers.
  2. Copy everything from the top down to the first blank line and paste it here.
  3. Read the findings, the delivery path and the Authentication-Results table.

Common scenarios

A suspicious invoice email

Check whether SPF, DKIM and DMARC all passed and whether the From domain matches the DMARC check.

Mail arrives late or looks delayed

The hop table shows the delay between each server. A long gap can point to retries or relay issues.

DMARC analyzer →

About this tool

Paste the full headers of a message (everything from Received: or From: down to the first blank line, as shown by "View source" or "Show original" in your mail client). The tool rebuilds the delivery path from the Received lines, reads the Authentication-Results header and flags failed checks, a long delay between hops, or a From address that does not match the DMARC check. Nothing you paste is sent anywhere.

🔒 Your input stays in your browser and is never sent anywhere.

Frequently asked questions

Where do I find the full headers of an email?

In most mail clients: open the message, then use a menu option like “Show original”, “View source” or “Message details”. Copy everything, not just the visible From/To/Subject lines.

What does a mismatched From domain mean?

DMARC checks whether the visible From address lines up with the domain that passed SPF or DKIM. A mismatch is exactly the pattern used in spoofing, though it can also happen with some legitimate forwarding setups.

Is this the same as checking SPF or DMARC for a domain?

No. The SPF and DMARC analyzers check what a domain currently publishes in DNS. This tool reads what actually happened to one specific message, based on the headers it carries.

Found a problem or have a suggestion? Tell us