日本語English

Mail Header Analyzer

Paste Gmail’s “Show original” or the headers of an .eml file to get the delivery route in time order, authentication results and mismatches with the From domain. Everything runs in your browser; no DNS, WHOIS or IP location lookups are made.

On-device・No uploadMobile friendlyWorks offline

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Paste Gmail’s “Show original”, the Internet headers from Outlook’s Properties, or the contents of an .eml file. If a body is attached only the headers are used. Nothing is sent, and no DNS, WHOIS or IP location lookups are made.

Drop an .eml or text file here

Accepts: .eml / .txtUp to 50 MB per file

How to use

  1. Email header

    Paste a mail header

  2. Delivery route and delay
    SPF, DKIM and DMARC

    See the route and checks

  3. Points to reviewNo DNS or IP lookups

    List points to review

Paste a mail header to see its route, sender checks and possible spoofing

  1. Paste the email headers into the input. In Gmail use “Show original”; in Outlook use the Internet headers in Properties. An .eml file also works (or press “Try the sample”).

  2. Under “Points that may indicate spoofing”, look for authentication failures and mismatches between From and Return-Path or Reply-To.

  3. In “Delivery route”, check each server’s time, the delay since the previous one, whether TLS was recorded and whether the IP is private or public.

  4. In “Authentication results” and “Match with the From domain”, see the SPF, DKIM and DMARC results and whether the DKIM d= and the SPF domain match From.

  5. To show someone else, copy the “For sharing” version, which replaces email addresses and IPs with numbers.

What it does

Route in time order

Received headers are sorted oldest first into a table of from, by, protocol, time (UTC) and the delay since the previous server. Delays of 60 seconds or more are highlighted, and so are places where the time goes backwards.

TLS and private IPs

Shows whether TLS was recorded (with ESMTPS and similar), and whether each hop’s IP is private (10.x, 192.168.x, 172.16–31.x, fd00::/8 and more) or public.

Authentication at a glance

Lists spf, dkim and dmarc from Authentication-Results, ARC-Authentication-Results and Received-SPF as pass, fail, softfail or none with colour and text, and reads d=, s=, a= and h= from DKIM-Signature.

DMARC alignment explained

Shows whether the DKIM d= and the SPF domain match the From domain (same, parent/child or mismatch). A different address inside the display name, a mismatched Reply-To or Return-Path and date drift are listed as points to check, not as verdicts.

Copy a hidden version

Copy or save all headers with email addresses and IPs replaced by [email-1] and [ip-1]. Encoded display names are decoded first, then hidden.

Use cases

  • Look for clues about whether a suspicious message really came from the domain it claims
  • Find which server added the delay when a message arrived late
  • Check how SPF, DKIM and DMARC were recorded for your own outgoing mail
  • Learn how Received and Authentication-Results read, using a real header
  • Hide addresses and IPs before sending headers to a help desk or a colleague

Capability matrix

FeatureSupportNotes
Parse headers (folded lines, =?UTF-8?B?…?= / Q encoded words, .eml, pasted text with a body)Supported—
Route, delays, recorded TLS and private/public IPsSupported—
List SPF, DKIM and DMARC results and check the match with the From domainPartialIt only reads recorded results. The match is a string comparison without the Public Suffix List, so organizational domains such as example.co.uk can differ from what DMARC decides
Verify DKIM signatures, fetch SPF records or check DMARC policyNot supportedThese need DNS lookups, which are not made. Use a DNS lookup tool for the domain’s records
IP country, region or provider, WHOIS, domain registrationNot supportedNo external lookups are made. IPs are only shown as private or public
Decide whether a message is genuineNot supportedIt only shows rough indicators. Headers can be forged by the sender, and genuine mail can show mismatches

Limits & notes

  • Pasted input is limited to 300,000 characters. For .eml and text files only the first 300,000 characters are read.
  • Up to 2,000 headers are read, and only the first 10,000 characters of one header are parsed.
  • Dates are read only when they have a numeric zone such as +0900. Dates with only an abbreviation such as JST cannot be read, so no delay is shown for them.
  • Received formats differ by server; anything that cannot be read is shown as “—”.
  • Authentication result headers can also be written by the sender. Check by host name that your own receiving server added them.
  • The hidden version removes only email addresses and IP addresses. Host names, domains, the subject, Message-ID and signature values stay.

Privacy & safety

Analysis of the pasted headers or file happens entirely in your browser and nothing is sent to or stored on a server. No DNS, WHOIS or IP location lookups or other outside requests are made.

FAQ

Where can I find the email headers?
In Gmail open the message, choose “⋮” at the top right, then “Show original”. In Outlook use the “Internet headers” in the message properties. In Thunderbird use View → Message Source. Copy everything and paste it here.
In what order should I read Received headers?
Each server adds its own on top, so the bottom one is the sender side and the top one is the last server to receive the message. This tool sorts them oldest first and shows the delay since the previous server. The bottom one was written by the sender and can be forged.
What do pass and fail mean for SPF, DKIM and DMARC?
SPF shows whether the sending server’s IP is on the domain’s allow list, DKIM whether the signature on the message is intact, and DMARC whether those results match the From domain. fail means the check did not pass, softfail is a weak warning that does not ask for rejection, and none means there was nothing to check.
Can it tell me whether an email is spoofed?
Not for certain. It points out clues such as a mismatch between From and Return-Path or Reply-To, another address inside the display name and failed authentication. Senders can forge headers, and delivery services or forwarding make genuine mail mismatch too.
Does it verify DKIM signatures?
No. Verification needs the public key from DNS for the signature’s selector and domain, and this tool makes no outside requests. It reads and shows d=, s=, a= and h=. What the receiving server verified is in Authentication-Results.
Are the pasted headers sent anywhere?
No. They are analyzed only in your browser, and no DNS or IP location lookups are made.

Encode / Decode Studio — Base64, URL, JWT & more

Paste %E3%81%82, an eyJ… token or any encoded string — the format is detected and decoded instantly. Errors say exactly which character is wrong and why, and nothing leaves your browser.

No upload

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.

No upload

IP / CIDR / Subnet Calculator

Enter an IP address or CIDR to get the network, broadcast, usable host range and subnet mask instantly. Split networks (VLSM), convert ranges to CIDR and check IP lists — for both IPv4 and IPv6.

No upload

HAR Sanitizer

Load a HAR saved from your browser developer tools and save a copy with cookies, auth headers, URL tokens, passwords and JWTs redacted, before you send it to support. A helper only — it cannot guarantee that every secret is found. The HAR never leaves your device.

No upload

Last updated: