Email Header Analyzer
Paste raw email headers to trace the sender path, detect spoofing, and inspect authentication results.
Security Analysis Tools
View All Tools →What is Email Header Analysis?
Email Header Analysis is a critical cybersecurity technique used to examine the metadata hidden within email messages. Every email you receive contains a complete audit trail of its journey from the sender's mail client to your inbox, including every server it passed through, timestamps, IP addresses, and authentication results. This forensic tool decodes that technical data to help you verify sender authenticity, detect phishing attempts, trace the geographic origin of suspicious emails, and investigate email-based threats.
When you analyze email headers, you're examining the "Received:" fields that show the complete routing path, checking SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication) authentication protocols, and identifying the originating IP address. This information is invaluable for security professionals, IT administrators, and anyone concerned about email security and phishing prevention.
How to Use Email Header Analysis Tool
Step-by-Step Guide
- 1.Extract Email Headers, Open the suspicious email in your email client:
- Gmail: Open email → Click three-dot menu (⋮) → Select "Show original" → Copy all text
- Outlook Desktop: Open email → File → Properties → Copy from "Internet headers" box
- Outlook Web: Open email → View → View message details → Copy headers
- Apple Mail: Open email → View → Message → Raw Source
- 2.Paste Headers, Copy the entire raw header text and paste it into the text area above
- 3.Analyze, Click the "Analyse Headers" button to process the information
- 4.Review Results, Examine SPF/DKIM/DMARC status, originating IP, server hops, and routing path
What to Look For
🔐 Authentication Results
SPF Pass: Sending server is authorized. DKIM Pass: Email wasn't modified in transit. DMARC Pass: Sender domain is protected against spoofing.
🌐 Originating IP Address
Check if the sender's IP matches their claimed location. Suspicious IPs from unexpected countries can indicate phishing.
📧 Return-Path vs From
If the Reply-To or Return-Path address differs from the From address, the email may be spoofed or fraudulent.
⏰ Received Timestamps
Analyze time delays between hops. Unusual delays or timestamp inconsistencies can reveal email forgery attempts.
Why Use Email Header Analysis?
Email header analysis is essential for cybersecurity investigations, phishing detection, and email forensics. Unlike the visible email content which can be easily faked, email headers contain technical routing information that's much harder to forge. Security teams use header analysis to trace the true origin of phishing emails, investigate business email compromise (BEC) attacks, verify legitimate senders, troubleshoot email delivery issues, and gather evidence for fraud investigations.
Common Use Cases
- ✓ Investigating phishing emails and identifying the attacker's real IP address
- ✓ Verifying email authenticity before clicking links or downloading attachments
- ✓ Detecting email spoofing attempts where the sender impersonates a trusted domain
- ✓ Troubleshooting email delivery problems by examining the routing path
- ✓ Validating SPF, DKIM, and DMARC authentication for email security compliance
- ✓ Gathering forensic evidence for security incident reports and legal investigations
Understanding Email Authentication
SPF (Sender Policy Framework)
SPF allows domain owners to specify which mail servers are authorized to send email on their behalf. When you analyze email headers, an SPF pass means the email came from an authorized server.
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature to emails that proves the message hasn't been tampered with during transmission. Our email header analyzer checks this signature to verify message integrity.
DMARC (Domain-based Message Authentication)
DMARC builds on SPF and DKIM by telling receiving servers what to do with emails that fail authentication checks. A DMARC pass provides the highest confidence in email authenticity.