Message route
We sort the Received headers chronologically and show the delay and encryption at each server.
Email Headers
Analyze email headers
Trace the message path and check the sender authentication results.
The analysis runs entirely in your browser. Headers are not sent to any server.
Header report
Analysis results
Basic information
Message path from sender to recipient
All headers
SPF, DKIM and DMARC
We read the results recorded by the receiving server and flag the checks the message failed.
Browser only
The analysis runs locally in JavaScript. Headers never reach our server or any third-party service.
Good to know
How do I get the message headers?
Gmail: open the message, click ⋮ and choose "Show original". Outlook: File → Properties → Internet headers. Thunderbird: View → Message Source. Copy the part up to the first blank line.
In what order should I read Received headers?
From bottom to top. The oldest header is at the bottom and shows where the message entered the public mail network. The report already shows the path in chronological order.
What do SPF, DKIM and DMARC mean?
SPF checks whether the sending server may send for the domain. DKIM confirms the message signature. DMARC combines both and says what to do with a message that fails the checks. The receiving server adds the results in the Authentication-Results header.
Are my headers sent anywhere?
No. The whole analysis runs in JavaScript in your browser. You can safely paste the headers of a confidential message.
Why is a fake sender possible?
The From field can be set to anything. That is why you should check Authentication-Results, Return-Path and the first Received header added by a trusted server, not the From field alone.