Email Header Analyzer: Trace, Verify & Spot Spoofing (Free, Runs in Your Browser)

Paste email headers or drop an .eml file to trace the route, check SPF, DKIM and DMARC, and spot spoofing. Free, no sign-up, and nothing is uploaded.

What it does

The Email Header Analyzer turns the wall of text behind “Show original” into something you can read. Paste raw headers or drop one or more .eml files, and it shows who really sent the message, which servers handled it, how long each hop took, and whether the sender passed SPF, DKIM and DMARC. It also flags the classic signs of a spoofed or phishing email, such as a display name that hides a different address, a Reply-To that points somewhere else, or a domain that imitates a well-known brand.

It is built for people who have to answer “is this email real?”: IT and security staff, small-business owners, journalists, and anyone who received a suspicious invoice or password-reset message.

How it works

Everything is read in your browser, with no server involved.

Route tracing. Each Received: header is parsed into sender, receiving server, protocol, TLS details and timestamp, then shown oldest hop first. Timestamps are normalized across time zones, so the delay at every hop is calculated correctly, and a timestamp that goes backwards is flagged as clock skew or tampering.
Authentication. The Authentication-Results, Received-SPF and DKIM-Signature headers are decoded. The tool then works out DMARC alignment itself, comparing the visible From domain with the envelope sender and the DKIM signing domain using the organizational domain, in relaxed or strict mode.
Real DKIM verification. If you provide the full message and the selector’s public key, the tool recomputes the body hash and checks the signature with your browser’s built-in WebCrypto, supporting rsa-sha256, rsa-sha1 and (where your browser allows it) ed25519-sha256. Both simple and relaxed canonicalization are handled.
Spoofing signals. Local checks cover duplicate From headers, display-name tricks, Return-Path and Reply-To mismatches, internationalized (punycode) and look-alike characters, brand-name imitation, odd dates, and servers that call themselves “localhost”.
Vendor headers decoded. Microsoft’s spam report (SCL, SFV, CAT), SpamAssassin scores and rules hit, bulk-mail levels and unsubscribe links are translated into plain English.

The result is a set of signals, not a single “risk score”. A clean result never proves an email is safe, and a warning does not prove it is fake.

How to use it

Get the raw headers. In Gmail open the message, choose the three-dot menu, then Show original. In Outlook use File → Properties → Internet headers. In Apple Mail use View → Message → All Headers. You can also save the message as an .eml file.
Paste the headers into the box, or drop one or more .eml files on the right. Several messages can be loaded at once and switched between with the chips at the top.
Start on the Summary tab: four lanes (Identity, Authentication, Alignment, Routing) show where to look first.
Open Routing for the hop-by-hop table and the delay chart, Authentication for SPF, DKIM, DMARC and ARC, and Findings for every signal with a plain-English explanation.
Switch Show times as between the sender’s own zone, UTC or your local time. If you are comparing timestamps across regions, the time zone converter is handy for double-checking a single moment.
Want to check a signature? On the Authentication tab, paste the selector’s TXT record into the box and press Verify signature locally.
Need to ask someone for help? Use Share-safe copy to mask addresses, IPs and names before you post the headers anywhere. For arbitrary text outside email, text-mask does a similar job.
Use Compare to line up a genuine email and a suspicious one and see exactly which headers differ.

Privacy

Almost everything here is local: parsing, route tracing, spoofing checks, DMARC alignment, DKIM verification, the share-safe copy and all exports run entirely in your browser. Your headers are not uploaded.

Two optional features do use the internet, and both are switched off by default:

DNS record lookup. If you tick it, the tool asks a public DNS-over-HTTPS provider (Cloudflare or Google, your choice) for the SPF, DMARC, DKIM key and MX records of the domains in the email. Only domain names and DKIM selectors are sent.
Reverse DNS check. If you tick it, the public IP addresses from the Received headers are sent to the same provider to check their hostnames.

Both boxes reset to unticked every time you open the tool. Nothing else leaves your browser. The “lookup” links beside IP addresses simply open a third-party website in a new tab when you click them; the tool itself sends nothing.

Saved messages are kept only in your own browser (so a refresh does not lose your work) and can be removed at any time with Clear all saved messages. Untick Remember messages in this browser on a shared computer.

Supported formats and limits

Accepted: pasted headers, pasted full messages, and .eml / .txt files, including text copied from Gmail’s “Show original” and Outlook’s Internet headers dialog.
Not supported: binary .msg and .pst files (export them as .eml or copy the headers), and S/MIME or PGP verification.
DKIM verification needs the complete message; a headers-only paste can check the signature but not the body hash. Copying a message through a web page can change line endings or whitespace, which makes a genuine signature fail, so a local failure is a prompt to investigate, not proof of forgery.
SPF check against the published record is partial: it matches ip4 and ip6 entries only and tells you when include, a or mx mechanisms were not evaluated. The receiving server’s own SPF result is the authoritative one.
ARC chains are displayed but not cryptographically verified.
DMARC alignment uses a built-in list of common two-part suffixes (such as co.uk and com.ng), not the full Public Suffix List, so very rare domain endings may be misjudged.
Look-alike and brand checks are heuristics and can occasionally flag a legitimate partner or reseller domain.
Authentication results and Received lines are claims made by the servers that wrote them. Only trust the ones added by your own mail provider.

FAQ

How do I find the full headers of an email?

In Gmail, open the message, click the three dots and choose Show original. In Outlook (desktop) open the message and go to File → Properties, where the headers are in the Internet headers box. In Apple Mail choose View → Message → All Headers. In Thunderbird press Ctrl+U (or Cmd+U). Copy everything from the first line down and paste it into the tool.

What do SPF, DKIM and DMARC actually tell me?

SPF says whether the server that delivered the message is allowed to send for the envelope-sender domain. DKIM says whether the message carries a valid cryptographic signature from a domain. DMARC ties them together: at least one of them must pass and match the address you see in the From line. A message can pass SPF and still be spoofed if the passing domain is not the one shown as the sender, which is why the tool checks alignment for you.

Can an email be fake even if SPF and DKIM pass?

Yes. A scammer can send from their own domain, such as a look-alike of your bank, and authenticate it perfectly. Passing authentication means the message really came from that domain, not that the domain is trustworthy. That is why the tool also checks for look-alike characters, brand imitation, display-name tricks and mismatched Reply-To addresses.

Why are some Received timestamps out of order or hours apart?

Mail servers have their own clocks, and some are wrong. A hop that appears earlier than the one before it usually means clock skew, but it can also mean a header was inserted by someone else. Long delays are often greylisting, queueing or a security scan. The tool highlights both so you know where to look.

Is it safe to paste a private email here?

The analysis runs in your browser and your headers are not uploaded. Only if you tick one of the two optional DNS boxes are domain names (or, for the reverse-DNS option, IP addresses) sent to the DNS provider you pick. If you want to share headers with someone else, use the Share-safe copy option to mask addresses, IPs and names first.

Why did DKIM verification fail on an email that my mail provider says is fine?

Most often the pasted text is not byte-for-byte what was signed: a web page or chat app re-wrapped a line, trimmed trailing spaces or changed the encoding. Try saving the message as an .eml file and dropping that in instead. Another common cause is pasting the wrong selector’s key, since the key record must match the s= and d= values in the signature.

I run a domain. How do I fix failing authentication?

Start by publishing correct records. The SPF and DMARC generator builds and explains them. If you need to look inside the message itself rather than just its headers, the EML viewer opens the body and attachments.