Email Header Analyzer

Every email carries a header block that records the servers it passed through and the receiving server's authentication checks. Paste the raw headers here to see the route hop by hop with the delay at each server, the decoded sender and subject, and the SPF, DKIM and DMARC results with a check of whether the authenticated domains match the From address. It helps trace slow delivery and spot spoofed or phishing messages. The text never leaves your browser.

How to use this tool

1. Open the message's raw source: Gmail ⋮ → Show original; Outlook File → Properties → Internet headers; Apple Mail View → Message → All Headers.
2. Copy everything above the message body and paste it here.
3. Read the authentication verdict and alignment first.
4. Use the route table to see where time was spent; the last hop is your own provider.

Formula

delay of hop n = time(hop n) − time(hop n−1) · total = time(last hop) − Date header

Folded lines are joined (RFC 5322), encoded words such as =?UTF-8?Q?Caf=C3=A9?= are decoded (RFC 2047), and every timestamp is converted to UTC using its own offset. Received headers are listed newest first in the message, so the table reverses them. SPF, DKIM and DMARC come from the first Authentication-Results header, which your provider added.

Example

In the sample, the message is dated 09:01:58 UTC. The sender's server logged it at 09:01:59, the recipient's MX at 01:02:08 −0800 (= 09:02:08 UTC) and the mailbox store at 09:02:10 UTC: 3 hops and 12 seconds in total. SPF, DKIM and DMARC all pass for example.com, and the subject =?UTF-8?Q?Caf=C3=A9_menu?= decodes to Café menu.