Donaldson R F Email Header Analyzer
Paste the raw headers of an email to see where it came from, how long each hop took, whether it passed SPF, DKIM and DMARC, and anything that looks suspicious.
How to read the result
Every server that handles an email adds a Received: header at the top, so the route is read from the bottom (first server) to the top (last). The delay column is the difference between the time stamps of two neighbouring servers; small negative numbers usually mean the servers’ clocks disagree by a few seconds. A hop from a private address (such as 192.168.x.x) is normal for the sender’s own network.
SPF says whether the sending server is allowed to send for the envelope (Return-Path) domain, DKIM is a signature that proves the message was not changed, and DMARC checks that at least one of them matches the visible From domain. The results come from the Authentication-Results header added by the receiving server — the tool reads them, it does not re-check them. To look up a domain’s live records use the SPF & DMARC checker, and to check a DKIM key use the DKIM record checker with the selector shown in the signature (s=).
Warnings are hints, not verdicts: mailing services legitimately use different Return-Path and Message-ID domains, and headers can be forged by the sender (only the ones added by your own mail server are trustworthy). Headers contain IP addresses and email addresses; they are analysed in your browser and never sent to us.
Frequently asked questions
How do I get the raw headers?
In Gmail open the message, choose the three dots and “Show original”. In Outlook use File → Properties (“Internet headers”). In Apple Mail use View → Message → All Headers.
Can I paste a whole email?
Yes, but only the header part (up to the first blank line) is analysed.
Is the email uploaded?
No. Headers are analysed in your browser.