How to use the Email Header Analyzer
- Open the email and copy its full headers: in Gmail use ⋮ → Show original; in Outlook File → Properties → Internet headers; in Apple Mail View → Message → All Headers.
- Paste them into the box — the analysis appears immediately.
- Read the summary: sender, the SPF / DKIM / DMARC verdicts and any warnings about spoofing.
- Look at the hops from first to last server to find where a delay happened, and the originating IP.
Reading email headers
Every mail server that handles a message adds a Received: line at the top, so the headers list the journey in reverse. The analyzer turns them around, works out the time between each hop and highlights slow ones — a delay of minutes usually points at a spam filter, greylisting or a queue on that server.
| Check | What it proves |
|---|---|
| SPF | The sending server’s IP is allowed by the sender domain’s DNS record |
| DKIM | The message was signed by the domain in d= and wasn’t changed on the way |
| DMARC | SPF or DKIM passed for the same domain as the visible From address — the key anti-spoofing check |
Signs of phishing
Be careful when DMARC fails, when the Reply-To or Return-Path uses a different domain than From, or when the display name claims to be a company the address doesn’t match. To check your own domain’s records, use the Email DNS Checker.
Also searched as: email header parser, analyze email headers, email header checker, trace email, email delay analyzer, check spf dkim dmarc, find email sender ip, message header analyzer.
Tools that pair well with the Email Header Analyzer
- WHOIS Lookup — Enter a domain to see its registrar, creation and expiry dates, domain age, status codes, nameservers and DNSSEC — or an IP address to find the network and organization that owns it.
- What Is My IP — Your public IP address and everything your browser reveals to the websites you visit — user agent, screen, language, timezone and request headers.
- HTTP Header Checker — Fetch any URL and see exactly what the server sends back — status code, redirect chain and every response header, with a plain-English explanation of the ones that matter for SEO, caching and security.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
Frequently asked questions
How do I find the full headers of an email?
Gmail: open the message, click ⋮ and choose Show original. Outlook: open it, then File → Properties → Internet headers. Apple Mail: View → Message → All Headers. Copy everything above the message body.
How do I find where an email was sent from?
The analyzer shows the originating IP: the first external server in the Received chain. Webmail services often hide the sender’s own IP and show their server instead.
Why was my email delayed?
Look at the hop with the largest delay. Minutes at the receiving side often mean greylisting or spam scanning; a delay on the sender’s side means a queue or a retry after a temporary error.
Are my headers uploaded?
No. They are parsed in your browser and never sent anywhere — important, because headers contain addresses and server details.
Can I install Email Header Analyzer as a web app and use it offline?
Yes. Email Header Analyzer is an installable web app (PWA) — installed from your browser, not downloaded from an app store. Click Install app at the top of this page in Chrome or Edge (Windows, macOS, Linux, ChromeOS) or on Android, use Share → Add to Home Screen on iPhone and iPad, or File → Add to Dock in Safari 17+ on a Mac. It then opens in its own window with its own icon, and because it runs entirely in your browser it keeps working offline. Firefox on desktop can’t install web apps. How installing works.