1001Ferramentas
Tools Categories Guides FAQ
About Contact Privacy Policy Terms of Use
📧 Security

Email Header Analyzer

Analyzes a raw email header: Received server chain, per-hop delays, SPF, DKIM, DMARC results and spoofing warning signs.

Everything runs in your browser; the header is never sent anywhere.

How to read the hop chain

Every server that touches a message adds its own Received line at the top of the header, so the raw text reads newest first. This page flips the order: hop 1 is the machine that first accepted the message and the last hop is your own mailbox. The delay column shows how many seconds each server sat on the message — a single hop holding it for hours is the usual cause of "late" email.

The lines below the hop count are what actually prove identity. SPF says the sending IP was authorized by the domain, DKIM checks a signature over the message body and DMARC requires one of the two to line up with the visible From. A message can show spf=pass and still be a fraud when the From domain differs from the envelope domain that passed — that is exactly what the warning list below looks for.

How to read a raw email header

The block Gmail hides behind Show original looks like noise, yet it holds the full route the message travelled. Paste it here and the page splits out the main fields, rebuilds the chain of servers the mail crossed and works out how long each one sat on it. It is the fastest way to tell whether that invoice notice really came from your bank or from a rented bulk-sending host.

Every server stamps its own Received line at the top of the header, so the raw text runs newest first. This page flips it: hop 1 is the machine that accepted the message first and the last hop is your own mailbox. Next to each hop you get the delay in seconds, with a proportional bar that highlights whichever server was responsible for the longest pause in transit.

The SPF, DKIM and DMARC badges come from the Authentication-Results field written by the receiving server. One detail trips people up: spf=pass on its own proves nothing about the sender you see on screen, because SPF validates the envelope domain rather than the From header. That is why the warning list compares the two, checks Reply-To and flags display names that carry an address different from the real one.

Frequently asked questions

Is the header I paste sent anywhere?
No. The whole analysis runs in JavaScript inside your tab, with no network request and no storage. You can test it by going offline before pasting: the page keeps working. That matters because headers routinely expose internal hostnames, originating IP addresses and message identifiers that should not leave the company.
Where do I find the header in my mail client?
In Gmail, open the message, click the three dots and pick Show original. In desktop Outlook, use File, then Properties, and read the Internet headers box. In Apple Mail, turn on View, Message, All Headers. In every case copy the whole block, from the first line down to the blank line that separates the body.
SPF passed but the alert is still red. Why?
Because a scammer can register a domain of their own, publish a valid SPF record for it and still write anything they like in the visible From field. The tool catches that mismatch by comparing the From domain against the Return-Path and the authenticated domain. DMARC exists to demand exactly that alignment, and it is usually the check that fails here.

Related Tools

🌐

CORS Config Validator

Validate a CORS configuration (allowed origins or *), checking the format and duplicates. Useful for safely configuring APIs and web servers.
📨

DMARC Record Builder

Create a DMARC record with policy (none/quarantine/reject), percentage, ruf/rua mailto and SPF/DKIM alignment.
📧

SPF Record Builder

Builds an SPF record step by step (ip4, ip6, include, mx, a, ~all, -all) and counts the terms that consume a DNS lookup, so you can compare against the limit of 10.