Delegate your day.
Email header analyzer
Paste the raw headers of a message and see the route it took, how long each hop held it, and what your mail server recorded for SPF, DKIM and DMARC.
You just approve.
The short version
- Each Received line becomes a hop, oldest first, with the delay it added.
- SPF, DKIM and DMARC come from the results your own mail server wrote down. The page doesn't check signatures itself.
- The headers are read in your browser and never uploaded.
The headers you paste are read in this page. Nothing is uploaded or saved.
How it works
Paste the full headers and the page splits them into fields, joins lines that were folded over several rows, and reads the ones that matter. It stops at the first blank line, because that's where headers end and the message begins. Nothing leaves your browser.
From the Received lines it builds the route. Each server that handled the message adds a line on top, so the page lists them oldest first and subtracts one time stamp from the next to show how long each hop took. RFC 5322 describes these trace fields.
From Authentication-Results it reads the SPF, DKIM and DMARC outcomes. RFC 8601 defines that header, which the receiving server adds. When it's missing, the page falls back to Received-SPF where there is one.
Then it compares the From, Return-Path and Reply-To domains and checks the Message-ID and Date headers.
How to copy the headers
In Gmail, open the email, select More next to the Reply button, and choose Show original. Select Copy to clipboard. Google's help page is Trace an email with its full header.
In classic Outlook for Windows, double-click the message to open it in its own window, then select File, then Properties. The headers are in the Internet headers box. Highlight them and press Ctrl+C.
In new Outlook and Outlook on the web, open the message and select More actions, then View, then View message details. Microsoft's page doesn't say how to copy the whole text from there. If you can't select it all, use classic Outlook's File and Properties route.
The Outlook steps are from Microsoft's View internet message headers in Outlook.
Reading the result
- SPF checks that the sending server is allowed to send for the domain (RFC 7208). DKIM checks a signature added by the sender (RFC 6376). DMARC ties both to the visible From domain and says what to do on failure (RFC 7489).
- A different Return-Path is common, since newsletter and bulk-mail services send for other domains. It's worth a second look only when the message also claims to be from your bank or an executive.
- A different Reply-To means your answer goes somewhere other than the sender. That's normal for support desks and a common sign of fraud, so read the domain.
- Delays of a few seconds are normal. A hop that holds a message for minutes can mean a queue, a retry or a spam check. A negative delay means a server's clock is off, so ignore that figure.
What it can't tell you
Received lines below your own provider's can be written by anyone, so a long route isn't proof the message took it. The page doesn't look up IP addresses or verify signatures, and a failed check is a reason to look closer, not a verdict. If a message looks dangerous, don't open its links.
If you're comparing mail apps, our write-ups of the best Gmail alternatives and the best Outlook alternatives are the place to start.
Questions, answered
How do I see the full headers of an email?
In Gmail, open the email, choose More next to Reply, then Show original. In classic Outlook for Windows, open the message in its own window and choose File, then Properties. The steps above link to Google's and Microsoft's own pages.
What do SPF, DKIM and DMARC mean?
SPF checks that the sending server may send for the domain. DKIM checks a signature added to the message. DMARC ties them to the From address and sets what happens on failure. Each shows as pass, fail or another result in Authentication-Results.
Does a failed SPF or DKIM check mean the email is fake?
Not on its own. Forwarding, mailing lists and misconfigured domains cause failures in real mail. Treat a failure as a reason to check the sender and the links, not as proof.
Are my headers uploaded?
No. The page reads the text you paste in your browser. It makes no request, and nothing is saved.
And the rest of the inbox
Otto reads what arrived across Gmail and Outlook, drafts the replies, books the time and keeps track of what you are still owed. It prepares each one and waits for you to approve it.
Try your next step in Otto
Core mail, calendar and tasks are free. AI has an allowance.
Open Otto