Email header analyzer

What this reads

The block of technical headers above the visible message body - From, Return-Path, Message-ID, every Received: line recording a hop between mail servers, and the Authentication-Results header where a receiving server records its own SPF/DKIM/DMARC verdicts.

Received hops, oldest at the bottom

Each mail server that handles a message prepends its own Received: header, so the header block reads newest-first - the hop closest to the top is the last server before it reached the recipient, and the one at the bottom is closest to the original sender. This lists them in that order with the approximate delay between consecutive hops, computed from each header's own timestamp.

Reading the authentication results

The Authentication-Results header is where the receiving server itself recorded whether SPF, DKIM, DMARC and ARC passed - shown here as separate pass/fail/other results, since a message can pass some and fail others.

Headers can be forged - this is analysis, not proof

Every header shown here, including From and Return-Path, is something the sender (or a forwarding server) wrote, and none of it is cryptographically guaranteed to be honest on its own. A mismatch between From and Return-Path, for instance, is common with mailing lists and legitimate forwarding, and also with spoofing - this flags it as worth noticing, not as proof of anything.

Nothing you paste is sent anywhere

All of this happens in your browser via JavaScript - the headers are never uploaded to this server, logged, or retained past leaving the page.