Email Header Analyzer

Every message carries a header block defined by RFC 5322, holding fields such as From, To, Subject, Date, and Message-ID. On top of these, each server along the path adds trace fields — chiefly Received lines and Authentication-Results — while the envelope sender and recipient come from the SMTP transaction described in RFC 5321.

The analyzer separates identity fields (From, Reply-To, Return-Path), the routing chain (Received), the verdicts (Authentication-Results), and metadata such as Message-ID and Date. Received lines are stamped in reverse order — the newest hop sits at the top and the originating server at the bottom — so reading upward from the bottom reconstructs the delivery path and its timestamps. The Message-ID should be globally unique, and its domain part often reveals the true sending system.

A header might end, at the very bottom, with "Received: from mail.sender.com (203.0.113.9) by mx.google.com" timestamped 10:00:01, then a line above it timestamped 10:00:04 for the next hop. The three-second gap is normal; a multi-minute gap between two hops points to a queued or throttled relay. An Authentication-Results line reading "spf=pass; dkim=pass header.d=sender.com; dmarc=pass" confirms the message is authenticated and aligned.

When reading headers, watch for these patterns that explain delivery or spoofing issues:

• Return-Path differs from the visible From — common on mailing lists, but also a spoofing signal worth checking.
• A large time gap between two Received hops — indicates delay or greylisting, not a forged header.
• dkim=pass but header.d does not match From — the signature is valid yet unaligned, so DMARC can still fail.
• Missing Authentication-Results — the receiver ran no checks, or a relay stripped the line.

• Which Received line shows the real sender? — The bottom-most Received line is the originating server; lines below your own boundary can be forged, so trust starts there.
• Why are there two From-like fields? — The envelope From (Return-Path) handles bounces; the header From is what the reader sees, and DMARC checks the latter.
• Is it safe to paste headers here? — Parsing runs locally in your browser, so the header contents are never uploaded.