Email header analyzer
Email header analyzer: paste the full headers of a message to see who sent it, the servers it passed through, delays between hops and the authentication results.
Analysis happens in your browser. Nothing is uploaded. In Gmail choose “Show original”, in Outlook open the message properties.
About the email header analyzer
Email header analyzer: paste the full headers of a message to see who sent it, the servers it passed through, delays between hops and the authentication results.
Part of SmartCalcy’s data & networking tools. It runs in your browser with no account, uses your own currency and units (change them at the top of the page), and gives estimates for information only, so check official guidance before you rely on a result.
How to use the email header analyzer
What it calculates and when to use it
Reads the full headers of an email and shows the route it took, the delay at each server, and the SPF, DKIM and DMARC results. It also flags signs of spoofing, such as a sending domain that differs from the From address. Everything happens in your browser.
How to use it, step by step
- Open the email’s raw headers: in Gmail choose “Show original”, in Outlook open the message properties.
- Copy everything above the message body and paste it into the box.
- Read the authentication results and the route, oldest hop first.
- Check the warnings for domain mismatches.
What each input means
- Email headers – The complete header block, starting with lines such as Received: and From:.
How to read the results
- Authentication – SPF, DKIM and DMARC results taken from the receiving server’s Authentication-Results header.
- Message details – From, To, Date, Message-ID, Return-Path, Reply-To and mailer.
- Route – Each server hop, its address and the time added between hops.
- Warnings – Domain mismatches and failed checks.
The formula
Received headers are added at the top by each server, so they are read bottom to top. The delay at a hop is its timestamp minus the previous hop’s. Total delivery time is the last timestamp minus the first.
A worked example
A message with spf=pass, dkim=pass and dmarc=pass sent from the same domain as its From address, delivered in 5 seconds across 2 hops, shows no warnings.
Assumptions and limits
- The receiving server’s Authentication-Results header is trusted. Earlier Received lines can be forged by a sender.
- Time stamps use each server’s own clock, so small negative delays can appear.
- Nothing is uploaded.
Common mistakes
- Pasting only part of the headers.
- Trusting the From name. It is easy to fake, so check the domain and authentication results.
- Treating a failed SPF as proof of fraud. Forwarded mail often fails SPF.
Frequently asked questions
How do I find the headers in Gmail?
Open the message, choose the three-dot menu, then “Show original”, and copy the header text.
What do SPF, DKIM and DMARC mean?
SPF checks the sending server. DKIM checks a signature on the message. DMARC says what to do when they do not match the From domain.
Can headers be faked?
Lines added by the sender can, but the topmost Received lines and Authentication-Results from your own provider are reliable.
Is my email uploaded?
No. The headers are analysed in your browser.