Paste the raw headers from a message and this will tell you whether it authenticated, trace every server it passed through, and flag the things that usually mean trouble.
Everything is parsed in your browser. The headers are never sent to this server, so nothing confidential in them leaves your machine.
How to get the raw headers
You need the source of the message, not the text you can read. Every client hides it in a different place:
- Gmail — open the message, click the three dots next to Reply, choose “Show original”. Use “Copy to clipboard”.
- Outlook — open the message, then File → Properties → Internet headers.
- Apple Mail — View → Message → All Headers, or Raw Source.
- Thunderbird — View → Headers → All, or Ctrl+U for the message source.
- On a server — the file in
/var/mail/or/var/spool/mail/, or the raw message held by your MTA.
Paste everything from the top down to the first blank line. That is where the headers end and the body begins.
What it checks
- SPF — did the sending server have permission to send for that domain? Read from the
Authentication-ResultsandReceived-SPFheaders. - DKIM — was the message cryptographically signed, and did the signature verify? A DKIM failure is the most common cause of “it landed in spam”.
- DMARC — did the domain’s published policy pass or fail, taking SPF and DKIM alignment into account?
- From versus Return-Path — when these domains differ, the message’s visible sender is not its envelope sender. This is normal for mailing lists, and it is also the shape of a spoof.
- Reply-To — if it points somewhere different from From, you may not be replying to who you think.
- The route — every
Received:hop, oldest first, with the delay between each. A long gap means greylisting, a queue, or a retry.
Reading the route
Header order runs backwards from reality. Each server that handles a message adds its own Received: line on top, so the first one you see is the last hop — the server that handed it to your mailbox. This tool reverses them so you read the journey in the order it actually happened.
The useful detail is the timing. If hop one to hop two took two seconds and hop two to hop three took forty minutes, something queued the message, and that is very often the entire explanation for a delayed delivery.
Why this runs in your browser
Most online header analysers upload the headers to their server. That means sending a third party the sender, the recipient, the subject, the message ID, the sending IP and the routing path of a private email.
This tool parses everything locally with JavaScript. Nothing is transmitted, nothing is logged, and nothing is stored. You can even load this page, disconnect from the network, and it will still work.
A caution on interpretation
A failed check does not automatically mean a forged message, and a pass does not automatically mean a safe one. Legitimate senders misconfigure their DNS constantly, and forwarding breaks SPF through no fault of the original sender. Use the results as a diagnostic, not a verdict on whether to trust the content.