Create a free account and get 10% off every order — for life. Applies automatically at checkout when you're logged in.
FairSoftware

Free tool

Free Email Header Analyzer

Paste raw email headers to trace the delivery route, spot delays and read the SPF, DKIM and DMARC results.

This is different from the DMARC report analyzer: here you paste the headers of a single received message, not an aggregate DMARC XML report.

Paste headers above to see the analysis.

This tool is free and unrelated to what we sell. FairSoftware supplies genuine one-off Microsoft licences — Office licences and Windows licences, delivered by email.

About this tool

Every email carries a full delivery record in its headers. Paste them here and the tool reconstructs the route hop by hop, shows how long each hop took, and pulls out the SPF, DKIM and DMARC results along with the From, Return-Path and Reply-To addresses so you can spot a mismatch. Parsing happens entirely in your browser — headers often contain private routing details and they stay on your device.

How to use the Free Email Header Analyzer

  1. Open the message in your mail client and show the original or raw source. In Gmail: the three-dot menu → Show original.
  2. Copy the header block (everything above the message body) and paste it in.
  3. Read the hop timeline from oldest to newest, with the delay at each step.
  4. Check the authentication panel for the SPF, DKIM and DMARC verdicts.
  5. Compare the From, Return-Path and Reply-To addresses for signs of spoofing.

Frequently asked questions

How is this different from the DMARC report analyzer?
Completely different input. This tool reads the headers of one individual message you received. The DMARC report analyzer reads the aggregate XML reports that receiving mail providers send to a domain owner, summarising millions of messages.
Are my headers uploaded?
No. Parsing runs in your browser and the headers never leave your device.
What does a DKIM fail mean?
The signature did not verify — usually because a forwarder or mailing list modified the message in transit, or the signing key has been rotated. It does not automatically mean the message is forged.
Why is one hop so much slower than the others?
Greylisting, queueing at a busy relay or content scanning. A single long delay in the middle of an otherwise fast chain usually points at a filtering appliance.

Related free tools

← Browse all free online tools