Skip to content
TextArray1.41.0
100% local

Email header analyzer

Trace an email’s delivery path and check its SPF, DKIM and DMARC results.

Input
Output
Related tools
HTTP header parserDeveloper tools
Email extractorDeveloper tools
Email quote stripperText cleaning
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
Email header analyzer
Paste the raw headers of an email and this tool reconstructs how it actually got to your inbox. It walks the chain of "Received" lines from the originating server to the final delivery hop, in the order the message travelled, and shows the delay between each step so you can see at a glance where a slow delivery got stuck.
The options control what the report includes. Turn on the Received chain to see every hop with its timestamp and the slowest step marked; the authentication section reads the "Authentication-Results" header and reports the SPF, DKIM and DMARC verdicts a receiving server already computed. The envelope section pulls out From, To, Subject and Message-ID, decoding MIME encoded-word headers (the "=?UTF-8?B?…?=" sequences mail clients use for non-ASCII subjects and names) back into readable text. When a spam filter has added a score — an X-Spam-Score or X-Spam-Status header — it is shown too, and the tool flags a mismatch between the visible From address and the Return-Path, a common sign of a spoofed or misconfigured sender.
Headers can be pasted with Windows (CRLF) or Unix (LF) line endings, and folded header lines (continuations starting with a space or tab) are unfolded automatically before parsing. Dates that a mail server wrote in a format the browser can't parse are shown as-is rather than guessed at, so the delay calculation never silently makes up a number.
Everything runs in your browser: headers often contain real IP addresses, internal hostnames and sender details, and none of that is uploaded anywhere. Copy the report, download it as a .txt file, or send it straight into another tool to keep investigating.
FAQ
Why does the chain start at the bottom of the pasted headers?
Each server prepends its own "Received" line, so the newest hop is always first in the raw text. The tool reverses that order to show the path the way the message actually travelled: from the sender to your inbox.
What do SPF, DKIM and DMARC results mean?
They are checks the receiving mail server already ran and recorded in the "Authentication-Results" header: SPF confirms the sending server is allowed to send for that domain, DKIM verifies a cryptographic signature wasn’t tampered with, and DMARC combines both against the domain’s policy. The tool reads and displays these results — it doesn’t re-run the checks itself.
What does a From / Return-Path mismatch mean?
The From address is what you see in your inbox; the Return-Path is where bounces go, and is often set by the actual sending infrastructure. A different domain isn’t always malicious — many legitimate services send on a domain’s behalf — but it’s worth checking against the SPF/DKIM/DMARC results above.
Some hops show "unknown time" — why?
A "Received" header without a parseable trailing date, or with a non-standard format, can’t be timed reliably. Rather than guess, the tool marks it as unknown and excludes it from the delay calculation.
Are my email headers uploaded anywhere?
No. Header parsing, date math and MIME decoding all run locally in your browser — nothing you paste here is sent to a server.