Email Header Analyzer

Overview

The email header analyzer splits an email's full header block into a readable summary — From, To, Subject, Date, message ID, and every Received: hop the message passed through. Paste the raw headers from your mail client's "view source" or "show original" option and each line is laid out with the field name, value, and (for Received lines) the hop's timestamp and server name.

Anyone investigating a delivery problem, a suspicious message, or a routing delay needs a quick way to read SMTP headers. Long-tail keywords covered: analyze email headers online, trace email Received hops, and check email message route.

How it works

Internet mail headers are defined in RFC 5322. Each header is a Name: value pair, with continuations indented and the block terminated by a blank line that separates headers from body. The most important headers for debugging are Received (added by every mail server the message touches, listed top-down in reverse-chronological order), From / Reply-To / Return-Path (sender identity), Message-ID (unique identifier), and the authentication-results trio for SPF, DKIM, and DMARC verdicts.

Parsing is mostly about handling line folding correctly, decoding RFC 2047 encoded words in subjects and display names, and extracting the structured parts of a Received line (the from, by, with, and id segments plus the trailing timestamp).

Examples

• A direct delivery has one or two Received hops; a forwarded message can have a dozen.
• Message-ID: <abc123@mail.example.com> identifies the message uniquely and survives forwarding.
• Date: Wed, 18 May 2026 14:23:01 +0000 is the sender's claimed timestamp — compare it to the earliest Received line to detect clock skew.
• Return-Path: <bounce-abc@sender.com> is the envelope sender, used for bounces and SPF alignment, often distinct from From:.

FAQ

How do I get the raw headers?

Gmail: "Show original". Outlook: "View message source". Apple Mail: "View → Message → All Headers". Most mobile apps cannot show full headers — use the desktop or web version.

Why are Received lines listed top to bottom in reverse time order?

Each receiving server prepends its line to the existing headers, so the top line is the last hop (your inbox) and the bottom line is the original submission.

What is the difference between From and Return-Path?

From: is the displayed sender. Return-Path: is the envelope address used for bounces and SPF checks. Mismatches are normal for bulk mail but are also a hallmark of phishing.

Does this tool send anything to a server?

No. Parsing happens in the browser; nothing leaves your machine.

Try Email Header Analyzer