Free tool, no signup
Free email header analyzer
Paste raw headers. See SPF, DKIM and DMARC results, every hop the message took, and where it was delayed.
How it decides
Stamps and hops
A parser, not an AI: it reads the sender checks your provider stamped on the message and times every server it passed through.
The sender checks
SPF pass
SPF (the domain's published list of allowed sending servers) passed: the server that sent the mail was on the list.
Rubric The sending server was authorised to send for that domain.
SPF fail
The sending server was not on the domain's list. A high severity finding.
Rubric The sending server was NOT authorised for that domain. Treat the sender as unverified.
SPF softfail
The domain doubts this server but did not block it. A medium severity finding.
Rubric The domain lists this server as probably not authorised, but did not reject it.
DKIM pass
DKIM (a digital signature on the message) passed: the domain signed it and nobody changed it on the way.
Rubric The message carries a valid signature from the domain and was not modified in transit.
DKIM fail
Either the message was changed in transit or the named domain never signed it. A high severity finding.
Rubric The signature did not validate. The message was altered, or it was not signed by that domain.
DMARC pass
DMARC (the rule tying SPF or DKIM to the visible From address) passed: the From line you see matches a domain that actually checked out.
Rubric The From address you see lines up with the domain that passed SPF or DKIM.
DMARC fail
The From address on screen does not match the domain that passed the checks. The usual shape of a faked sender.
Rubric The visible From address does not line up with the authenticated domain. This is the classic spoofing signature.
No result stamped
If the paste has no Authentication-Results or Received-SPF line, the tool says so and asks for the full block from Show original, rather than reporting any check.
Rubric No authentication results in this paste
The findings
Display name spoof
If the bold sender name contains an email address that is not the real From address, that is a high severity finding, because mail apps show the name and hide the address.
Rubric Display name contains a different address
Return-Path mismatch
If bounces go to a domain unrelated to the From domain, that is a medium severity finding, with a note that this is normal for mailing lists and marketing platforms.
Rubric Return-Path domain does not match From
Reply-To mismatch
If hitting reply would send to a different address than the From, the tool says so: info severity on the same domain, medium on a different one.
Rubric Replies go to a different address
The slowest hop
When one server held the message for a minute or more, the tool names the hop and the wait, and explains a few minutes at one hop as greylisting (a receiving server's deliberate first-try delay), not a problem.
Rubric Delays of a few minutes at one hop are usually greylisting.
No delivery path
If the paste has no Received lines, the tool says the route could not be rebuilt and asks for the raw source rather than the message text.
Rubric No delivery path found
Pasted headers are text to pattern-match in the server process and nothing else: no model call, no execution, no storage, no logging, and the analytics event never includes the input. Only the parser's own fixed wording is ever shown back to you. There is no model in this tool. Every line above is something the parser computes from the text you paste, and it gives the same answer every time.
Questions
What people ask
The answers worth having before, and after, you use the tool.
How do I get the raw headers of an email?
In Gmail, open the message, click the three-dot menu and choose Show original, then copy the block of text. In Outlook on the web, open the message menu and choose View, then View message source. In Apple Mail, use View, then Message, then Raw Source.
What do SPF, DKIM and DMARC actually tell me?
SPF says whether the sending server was allowed to send for that domain. DKIM says whether the message was signed by the domain and arrived unmodified. DMARC ties the two to the From address you actually see. A pass on all three means the From address is very likely genuine.
Can headers be faked?
The From line and most Received lines can be forged by the sender. The Received lines added by servers you trust, and the authentication results your own provider stamped on arrival, cannot. Read the analysis from the bottom hop upward and trust the top entries most.
Why was my email delayed?
Each hop carries a timestamp, so a long gap between two Received lines shows exactly which server held the message. Greylisting at the receiving end is the most common cause of a delay measured in minutes; queue backlogs at the sender cause the longer ones.
Do you store the headers I paste?
No. Parsing happens on the server for the length of the request and nothing is written to a database or a log. Headers can contain internal hostnames and recipient addresses, so nothing is kept after the response is sent.
This tool handles one email. Batmail handles the rest.
Reading headers proves where one message came from. Batmail does the standing version of this job: every message, every night, sorted by what it is and what it needs from you. Emailchaser has its own version of this one: its email header analyzer traces the same Received hops and reads the same SPF, DKIM and DMARC results. Emailchaser is built by the same team as Batmail.
More free tools
Other things you can do here
All free, all without an account.