Email header analyzer

How it works

Every mail server that handles a message adds a Received line to the top of its headers. We read them from the bottom up to rebuild the delivery path, oldest hop first, and show how long the message waited at each step.

The receiving server records its checks in Authentication-Results: SPF (is the sending server allowed?), DKIM (is the signature valid?) and DMARC (do they match the From domain?). Headers added further down could be forged by the sender, so we trust only the topmost one.

For each DKIM-Signature, we look up the signing key in DNS and check its size. We also check the reverse DNS of the IP that handed the message to the receiving side.

Headers can contain names and addresses. We analyze them and forget them: nothing you paste is stored, so there's no share link for this tool.