Email Header Analyzer - Decode Headers & Check for Scam Emails
Paste email headers to trace the complete delivery path, verify SPF/DKIM/DMARC authentication, identify the originating IP, and see whether the message shows signs of a scam.
Understanding Email Headers
Email headers are like the digital envelope of an email, containing crucial metadata about its journey from sender to recipient. They are not usually visible in standard email clients but can be accessed via "Show Original" or "View Source" options.
Key Information in Headers:
- From/To/Cc/Bcc: Sender and recipient addresses.
- Subject: The email's subject line.
- Date: When the email was sent.
- Message-ID: A unique identifier for the email message.
- Received: A series of entries tracing the path the email took through various mail servers. Each "Received" header is added by a server that handled the email. Analyzing these can help identify the origin and route.
- Return-Path: The address where bounce messages are sent.
- Authentication-Results: Contains results of security checks like SPF, DKIM, and DMARC, which help verify the sender's authenticity and prevent spoofing.
- MIME-Version & Content-Type: Define the email's format (e.g., HTML, plain text) and character encoding.
Email Authentication Explained
SPF (Sender Policy Framework)
SPF allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. When an email is received, the receiving server checks if the sending server's IP address is listed in the domain's SPF record.
- Pass: The email came from an authorized server
- SoftFail: The domain suggests the host is not authorized but isn't asserting it strongly
- Fail: The email came from an unauthorized server - likely spoofed
- Neutral/None: No policy or no assertion made
DKIM (DomainKeys Identified Mail)
DKIM adds a digital signature linked to a domain name to each outgoing email message. Receiving servers can verify this signature to ensure the email was not altered in transit.
- Pass: The DKIM signature is valid - content wasn't modified in transit
- Fail: The signature couldn't be verified - message may have been tampered with
- None: No DKIM signature present
DMARC (Domain-based Message Authentication, Reporting, and Conformance)
DMARC builds on SPF and DKIM to help email senders and receivers work together to combat email spoofing and phishing.
- Pass: The message passed either SPF or DKIM and the identifiers are aligned
- Fail: The message failed both SPF and DKIM or the identifiers aren't aligned
- None: No DMARC policy published or applicable
Why Analyze Email Headers?
- Troubleshooting Delivery Issues: Identify where an email got delayed or rejected.
- Detecting Phishing & Spoofing: Uncover forged sender information or suspicious routing by scrutinizing authentication results and the received path.
- Spam Investigation: Determine the true origin of spam emails.
- Learning Email Flow: Understand the technical journey of an email.
Common Issues Identified Through Header Analysis
- Sender Spoofing: Mismatch between the "From" address and actual sending server
- Missing or Failed Authentication: Emails without SPF, DKIM or with failed validation
- Suspicious Routing: Email taking unusual paths through unexpected or known-problematic servers
- Time Anomalies: Unusual delays between server hops that may indicate issues
- X-Headers Anomalies: Custom headers sometimes reveal information about spam filtering or other processing
Is this email a scam? How to check the headers
Every message carries a block of headers your mail app hides from you. They record which server actually sent it, whether the sending domain approved that server, and where a reply would really go. A scam has to forge all three, and it usually gets at least one of them wrong.
Paste the full header block into the box above and the scam email checker reads it for you. The Security Assessment card returns a scam risk of Low, Medium or High, lists what triggered it, and says what to do next. Your headers are analysed on the server for that one request and are never stored.
Five signs it looks for:
- Authentication failures. SPF, DKIM and DMARC are the sending domain's own way of saying "this server speaks for us". A fail means it did not.
- A From address that does not match the envelope. The address you see and the address bounces go back to should belong to the same company. Forged mail often splits them.
- A Reply-To pointing somewhere else. You answer what looks like the brand, and your answer lands in a stranger's inbox.
- A brand name in front of a webmail address. "PayPal Support" writing from a gmail.com account is not PayPal. Large companies send from their own domain.
- A delivery chain with holes in it. Servers that announce themselves as a bare IP or as "unknown", or hops carrying no timestamp, mean part of the route was written by hand.
Legitimate mail from a large company looks the opposite way round. SPF, DKIM and DMARC all pass, the From domain matches both the DKIM signing domain and the bounce address, any Reply-To stays on that same domain, and every server in the chain names itself and stamps a time.
If you are asking "is this email a scam" because it wants a password, a payment or an urgent decision, stop before you click anything. Open the company's website or app yourself, the way you normally would, and check your account there. If the warning in the email is real it will be waiting for you. Then report the message as phishing in your mail app and delete it.
A scam email checker that reads headers has limits worth knowing. It cannot open attachments or follow the links in the message body, so a Low result means nothing in the routing looks wrong, not that the message is safe.
How to trace an email to its sender's IP address
Every mail server that touches a message stamps a Received line on top of the ones before it. Read that stack from the bottom up and you get the route the message took, starting with the machine that first accepted it.
- Copy the raw headers. Open the message, pick your mail app's raw or original view, then copy the whole block from the first Received or Return-Path line down to the Subject line.
- Paste it above and run the analyzer. The Routing Path view rebuilds the chain in the order it happened, so row 1 is the oldest hop and the last row is your own mailbox.
- Read row 1. It carries the hostname and IP of the server that handed the message to the internet. When you trace an email, that address is as close to the origin as the headers can take you.
- Check the address and the authentication. Run the IP through our IP Lookup to see who owns the network, then open the Authentication view. SPF, DKIM and DMARC tell you whether the sending domain approved that server at all.
How to find the full email headers
Mail apps hide headers behind a menu item with a different name in every product. Use the one that matches yours, then paste the result into the box above.
Gmail
Open the message, click the three dots beside Reply, choose Show original, then use the Copy to clipboard button on the page that opens.
Outlook.com
Open the message, click the three dots at the top right, then choose View and View message source. Select the text and copy it.
Outlook desktop app
Double-click the message so it opens in its own window, go to File and then Properties, and copy the box labeled Internet headers at the bottom.
Yahoo Mail
Open the message, click the three dots above it, then choose View raw message.
Apple Mail
Select the message, then use View › Message › All Headers. Raw Source in the same menu gives you the message body as well.
Proton Mail
Open the message, click the three dots at the top right, then choose View headers. Export as .eml also works if you want the whole message.
Mozilla Thunderbird
Select the message and press Ctrl+U for the source, or turn on View › Headers › All to keep them visible.
What a header trace can and cannot prove
A sender can forge the lower Received lines before a message ever leaves their machine, so trust only the hops your own mail provider added at the top of the chain. Anyone writing from Gmail, Outlook.com or another webmail service also hands you the provider's outbound server IP rather than the computer they typed on, which is why a trace email lookup usually ends at a data center instead of a home address.
Example headers
A short chain looks like this. The Received lines wrap onto continuation lines that start with a space or tab, and the analyzer joins them back together before it reads them.
Return-Path: <[email protected]> Delivered-To: [email protected] Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) by mx.example.com (Postfix) with ESMTPS id 8DBCF21478 for <[email protected]>; Wed, 21 Jul 2021 14:22:01 -0700 (PDT) Authentication-Results: example.com; dkim=pass [email protected]; spf=pass (example.com: domain of [email protected] designates 209.85.221.53 as permitted sender) [email protected]; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=example.com From: "Sender Name" <[email protected]> To: "Recipient Name" <[email protected]> Subject: Example Email with Headers Date: Wed, 21 Jul 2021 14:22:00 -0700 Message-ID: <[email protected]>
Related Tools
Frequently Asked Questions
What information is in email headers?
How can I tell if an email is spoofed?
What do the 'Received' headers mean?
What are SPF, DKIM, and DMARC?
Can I trust the From address?
Why does email show a different time than it was sent?
How can I tell if an email is a scam from its headers?
The email says it is from PayPal but the checker flagged it. Why?
The scam risk came back Low. Does that mean the email is safe?
How this tool works: This tool runs in your browser and on our server in real time. Depending on the tool, results are computed directly from the input you provide or retrieved from live, authoritative data sources at the moment you run a lookup. We do not sell your data, and your lookups are kept private — any history shown here is stored only on your device.