Free email header analyzer. See how an email reached you.
Paste an email’s hidden details (its headers) to see where it came from, whether it passed the sender checks, and why it may have been late. In plain English, and nothing leaves your computer.
What are email headers, and what do they look like?
Every email carries a hidden record of where it came from and how it travelled. That record is the headers. You do not see it when you read the email; your email app has an option to show it.
Headers are a long block of text, usually longer than the email itself. Each line starts with a label and a colon, like this:
Received: from mail.example.com (198.51.100.25)
by mx.example.net; Wed, 8 Oct 2026 09:15:40 -0700
Authentication-Results: mx.example.net; spf=pass
Subject: Your October invoice
Date: Wed, 8 Oct 2026 16:15:30 +0000
If what you copied is the message you read (for example "Hi Pat, here is your invoice"), that is not the headers. If it only shows From, To, Subject and Date, it is the short version. See how to copy the full headers.
Stays on your computer: nothing is uploaded, saved or shared. Not sure how to copy the headers? See the steps below.
How to find the headers
Gmail on a computer: open the email, select More (the three dots next to Reply), then Show original. Select Copy to clipboard and paste it above.
New Outlook for Windows and Outlook on the web: open the email, select More actions at the top of the message, then View and View message details. Copy everything in the window.
Classic Outlook for Windows: double-click the email to open it in its own window, select File and Properties, then copy everything in the Internet headers box.
Headers are easiest to copy on a computer. If you copy the whole Gmail page, the summary at the top and the message below are skipped automatically.
What this can and cannot tell you
Every email carries hidden details, called headers, that record its journey. The analyzer reads them and answers three plain questions: did it come from a server the sender allows, was it changed on the way, and does it match the name in the From line. It also shows each mail server the email passed through and how long each step took, and points out anything missing or odd.
Those answers were written into the headers by the email providers; we read them, we do not re-check them. An email can pass every check and still be a scam, because a scammer can set up their own web address properly. So the headers cannot prove an email is safe, genuine, or that it will reach the inbox.
To check a domain’s own settings instead, use the email and DNS checker.
Common questions
Are my email headers uploaded anywhere?
No. The analysis runs entirely in your browser. The headers are not uploaded, stored, logged, or sent to any AI or analytics service. Closing or clearing the page removes them.
Does a pass mean the email is safe?
No. SPF, DKIM and DMARC results show what the receiving server recorded about the sender’s domain. A scammer can pass all three using their own domain. Headers cannot prove an email is safe, genuine, or that it will reach the inbox.
Why are there several authentication results?
Each server that checks a message can add its own record. The top one is normally written by your own email provider and is the one to rely on. Records further down were written along the way and could have been added by anyone in the chain.
Why does it say a delay could not be estimated?
Each server stamps its own time. When a time is missing, unreadable, or earlier than the step before it (clocks or time zones disagree), we show that instead of guessing.
How do I read email headers?
Read them from the bottom up. The lowest Received line is where the email started and the top one is where it arrived; the times on each show any delay. The Authentication-Results line near the top shows whether the sender checks passed. This analyzer does that reading for you and explains each part in plain English.
How can I tell if an email is spoofed?
Look at the sender checks your provider recorded. A failed DMARC result means the email did not match the domain shown in the From line, which is the usual sign of a fake. A pass only shows the email matched its own domain: scammers often use look-alike domains that pass, so always check the From address carefully too.
Why did an email arrive late?
Each mail server stamps the time it handled the email. The analyzer lists those steps in order with the gap between each, so you can see which server held the message, for example a spam filter or a busy relay.
Can you fix the problem the headers show?
Yes. We fix email delivery problems remotely for Microsoft 365, Google Workspace and other providers, and quote a one-time repair before we start.
Related help
Free email and DNS checker
Check your mail servers, SPF and DMARC in seconds, explained in plain English.
Free email blacklist checker
See whether the address your email is sent from is on a spam blocklist, and how to get off it.
Business email going to spam
Authentication, reputation, and the fixes that actually move the needle.
Free SPF checker
See if your approved-sender list exists, is valid and protects your domain.
Free DMARC checker
See whether fake emails using your domain are watched, sent to spam or blocked.
Microsoft 365 administration
Licences, accounts, security settings and the day to day of running a tenant.
Get a quote
Tell us what you need and we will map out the simplest path.
Need help fixing email delivery?
If messages bounce, arrive late or land in spam, we can trace the cause and quote a one-time repair, done remotely.