What this analyzer looks at
- Received chain — every mail server that touched the message, in order, with the delay introduced by each one.
- SPF, DKIM, DMARC — the verdicts the receiving server recorded, with a plain-English explanation of each.
- Identity mismatches — Return-Path or Reply-To domains that disagree with the visible From address.
- Spam scoring headers — SpamAssassin, Microsoft SCL, Proofpoint and Barracuda verdicts when present.
- Missing basics — an absent Message-ID or authentication block, both common in forged mail.
Frequently asked questions
What is an email header?
The email header is the hidden block of metadata at the top of every message. It records every mail server that handled the message (Received lines), the claimed sender, the Message-ID, and the results of SPF, DKIM and DMARC authentication checks.
How do I find the raw headers of an email?
In Gmail open the message, click the three-dot menu and choose 'Show original'. In Outlook open the message, go to File > Properties and copy the Internet headers. In Apple Mail use View > Message > Raw Source.
How can headers tell me if an email is spoofed?
Look for dmarc=fail or spf=fail in the Authentication-Results line, a Return-Path or Reply-To domain that differs from the visible From domain, or a missing Message-ID. Any of those together with an urgent request is a strong phishing signal.
Why was my email delayed?
Each Received line carries a timestamp. The analyzer calculates the gap between hops, so a single slow server stands out immediately — usually greylisting, queueing or an antispam scan.
Is my email data uploaded anywhere?
No. The entire analysis runs in your browser. Nothing you paste is sent to a server or stored.
More free email tools
Launching a brand that needs a trustworthy sending domain? Browse our premium domain marketplace — premium names, was $9,999 — now $1,000.