Email Header
Analyzer

What Email Headers Reveal

Email headers contain a wealth of information about an email's journey from sender to recipient. They include authentication results (SPF, DKIM, DMARC), routing information showing each server the email passed through, timestamps for delivery tracking, and security indicators like TLS encryption status. Headers are added in reverse chronological order, with the most recent at the top, allowing you to trace the complete path of an email.

Key Headers to Examine

• Authentication-Results: SPF, DKIM, and DMARC verification status
• Received: Each server hop with timestamps and protocols
• Return-Path: Bounce address, should match From domain
• Message-ID: Unique identifier for tracking
• X-Originating-IP: Original sender's IP address
• X-Spam-Score: Spam assessment from filters

Detecting Email Spoofing

Headers help identify spoofed emails through authentication failures and inconsistencies. Check if SPF, DKIM, and DMARC all pass for the claimed sender domain. Examine the Received headers for suspicious routing paths or unfamiliar servers. Compare the Return-Path with the From address - mismatches often indicate spoofing. Look for missing or malformed Message-ID headers, which legitimate mail servers always include.

Troubleshooting Delivery Issues

When emails are delayed or blocked, headers provide diagnostic information. Check Received headers to identify where delays occurred. Look for X-Spam headers indicating why an email was flagged. Verify authentication passes to ensure proper configuration. Review any X-Blocked or X-Quarantine headers that explain filtering decisions. The complete routing path helps identify problematic mail servers or network issues affecting delivery.