📧 parsed locally — the header text never leaves your browser
Email Header Analyzer
Paste raw email headers (View Source / Show Original in your mail client) to see the hop-by-hop delivery path, per-hop delays, and SPF/DKIM/DMARC authentication results - useful for spotting phishing. Entirely client-side.
Delivery path (earliest hop first)
How it works
The parser first unfolds wrapped "Received:" lines (continuation lines indented with whitespace get joined back onto the header they belong to), extracts each hop's from/by hosts and RFC 2822 timestamp, reverses the list into chronological order, and separately pulls SPF/DKIM/DMARC results straight out of the Authentication-Results header with regex.
FAQ
- Why are the hops shown in reverse order from how they appear in the raw header?
- Each mail server prepends its own "Received:" line to the top of the header as a message passes through, so the raw header lists the most recent hop first. The analyzer reverses that order so the delivery path reads chronologically, from the originating server to the final one.
- What does "clock skew" mean in a hop's delay?
- It appears when a later hop's timestamp is earlier than the previous hop's, which the parser flags instead of showing a negative delay. That usually just means the two mail servers' clocks aren't perfectly synced, though large or inconsistent skew alongside a suspicious sender is worth a second look.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.
Say thanks — $3