Email Header Parser

How to use the email header parser

1. Copy the full headers from your mail client — usually 'Show original' or 'View source'.
2. Paste them in.
3. Read the delivery path and authentication results.

About this tool

Email headers record the route a message took and what each server thought of it. They are also close to unreadable in raw form, which is what this untangles.

Headers can be folded across several lines with continuations indented, so lines are unfolded before anything else. Reading them line by line — which is what a naive parser does — splits long `Received` headers in the middle and loses most of the routing information.

`Received` headers are prepended by each server, so the raw list reads newest first. They are reversed here into the order the message actually travelled, with the delay between hops calculated. A large gap at one hop is usually where a message was delayed, and that is generally the question being asked.

SPF, DKIM and DMARC results are pulled out and explained. Those three are the useful signal when judging whether a message is what it claims to be: SPF says whether the sending server was authorised, DKIM whether the signature matches, and DMARC whether either aligned with the visible From address. A message can pass SPF and DKIM while still being from an impostor if neither aligns with what the recipient sees.

Everything is parsed in the page. Headers contain the recipient's address, the sending server's address and the full delivery path, so pasting them into a site that uploads them would be handing over exactly the information you are trying to investigate.

Common uses

• Working out where a message was delayed.
• Checking whether a suspicious message passed authentication.
• Tracing which server rewrote or forwarded a message.

Frequently asked questions

Where do I find the raw headers?

In Gmail, 'Show original'. In Outlook, message properties or 'View source'. In Apple Mail, View then Message then Raw Source.

What do SPF, DKIM and DMARC mean?

SPF says whether the sending server was authorised by the domain. DKIM says whether the signature matches. DMARC says whether either aligned with the From address you actually see — which is the one that matters for impersonation.

Are my headers uploaded?

No. They are parsed in the page, which matters because headers contain addresses and the full delivery path.