No upload, 100% local, no account

Email header analyzer

Paste the full header block of an email (view source / show original) to see its declared hops and authentication results.

How Email header analyzer works

Email header analyzer parses a raw email header block you paste (from your mail client's "show original" / "view source" option) entirely in your browser: it lists the Received hop chain in chronological order with the time between hops, the SPF/DKIM/DMARC outcomes as declared by the Authentication-Results header, and whether the From address's domain differs from Reply-To or Return-Path. Nothing you paste is sent anywhere.

This reads and reformats what the message's OWN headers already say, on your device: it performs NO DNS lookup, NO cryptographic DKIM signature verification, and NO phishing or reputation scoring. A "pass" shown here means the header itself declares pass, not that Sunasty independently verified it; a missing or mismatched signal is reported as exactly that, never treated as proof of anything on its own.

Written by Bastien Sulyan

How to use Email header analyzer, step by step

  1. Open the suspicious or interesting email in your mail client and find "show original" or "view source" (view message source).
  2. Copy the entire header block (everything above the message body) and paste it into the input box.
  3. Review the Authentication-Results panel for the declared SPF/DKIM/DMARC outcomes.
  4. Check the From/Reply-To/Return-Path addresses for a domain mismatch.
  5. Read the Received hop chain to see the path the message claims to have taken and the time between hops.

Common use cases

  • Checking whether a suspicious email's Reply-To address quietly points to a different domain than the From address before replying.
  • Reviewing the declared SPF/DKIM/DMARC results on a phishing-suspected email as one input among several before deciding whether to trust it.
  • Understanding how long a legitimate email took to travel through intermediate mail servers by reading the Received chain timestamps.
  • Learning how email headers are structured by pasting a real header and seeing it broken down field by field.

Frequently asked questions

Does this tool verify DKIM signatures or look up DNS records?

No. It only reads and reformats the values already present in the pasted headers, in particular whatever the receiving mail server already wrote into the Authentication-Results header. It makes no DNS query and performs no cryptographic verification of its own.

Is this a phishing detector?

No. It is a header parser, not a scam or phishing scorer. A domain mismatch or a failed authentication result is a signal worth investigating, not proof of anything on its own; a passing result is likewise not a guarantee the message is legitimate.

Is my pasted header sent to a server?

No. Parsing runs entirely in your browser using plain text pattern matching on what you pasted. The header text never leaves your device.

What does a From/Reply-To or From/Return-Path mismatch mean?

It means the domain a reply would go to (Reply-To) or a bounce would go to (Return-Path) differs from the domain shown in the visible From address. This is common in legitimate mailing-list and marketing setups, and also a technique used in some phishing, so it is reported as a signal, not automatically flagged as malicious.

Why do some hops in the Received chain show no timestamp?

Received headers have no single, fully standard grammar across every mail server implementation; when the trailing date text after the last semicolon does not parse as a valid date, this tool reports the raw text without inventing a timestamp, and the delay to/from that hop is left unknown rather than guessed.

Can I paste just the Subject and From lines instead of the full header?

You can, and the tool will parse whatever fields are present, but the Received chain and Authentication-Results sections will be empty or incomplete without those specific headers pasted in.