Email
LIVE
Email Header Analyzer
Analyze email headers to trace path and delays
usage:
header-analyze --input What is Email Header Analyzer?
Email Header Analyzer analyzes the complete headers of an email to trace the message path from sender to recipient. It shows each server hop, delivery delays, authentication checks (SPF, DKIM, DMARC), and helps identify delivery issues or suspicious emails.
Frequently Asked Questions
What are email headers? +
Headers are hidden metadata present in every email containing information about the message path, servers involved, timestamps, and authentication verification results.
How do I find the headers of an email? +
In Gmail: open the message > three dots > Show original. In Outlook: open the message > File > Properties > Internet Headers. In Thunderbird: View > Message Source.
How do I identify a phishing email from headers? +
Check the From vs Return-Path fields (if different, it is suspicious), verify SPF/DKIM/DMARC results, examine the IPs of the Received servers to spot unusual origins.
What does the Received field indicate in headers? +
Each server handling the email adds a Received field with its IP, hostname, and timestamp. They are read from bottom to top to reconstruct the chronological path of the message.
Why do my emails arrive late? +
Header analysis shows the time spent at each hop. Significant delays between two Received fields indicate server queues, active greylisting, or DNS issues in that segment.
What is the Authentication-Results field? +
It is the header added by the receiving server with the results of SPF, DKIM, and DMARC checks. Values like pass, fail, softfail indicate the outcome of each authentication check.