Free tool · no signup
Email header analyzer
Paste the full headers of a message to see the route it took, where it was delayed, whether SPF, DKIM and DMARC passed, and the signs that it is not what it claims to be.
By the Bug Circuit security team · Last updated
Paste the full headers
Paste the headers on the left to see the route, the checks and the warning signs.
How it works
How to copy the headers
In Gmail open the message, click the three dots and choose Show original, then copy the text at the top. In Outlook open the message, choose File, Properties and copy the Internet headers box. In Apple Mail choose View, Message, All Headers. Copy everything above the message body. The tool stops at the first blank line, which is where the headers end.
Use the copy from the inbox that received the message. The Authentication-Results header is added by the receiving server, so a forwarded copy or a copy from the sender's Sent folder will not have the checks you want.
What it reads
Each Received line is one server handing the message on. Read from the bottom up they show the route from the sender to you, with the time at each step, so the tool lists them oldest first and works out the delay between hops. A long gap points to greylisting, a queue or a filter holding the message, and a clock that is out of step shows as a negative delay.
Authentication-Results records what the receiving server found. SPF says whether the sending server is allowed to send for the envelope domain, DKIM says whether a signature on the message is valid, and DMARC says whether at least one of them passed and lines up with the From address. The tool also looks at the signature itself, so you can see which domain actually signed the mail.
Signs of a fake
A From address that does not match the Return-Path is normal for newsletters and invoices sent through a service, but it is also what a spoof looks like, so the tool treats it as a small warning on its own. The signs that carry weight are a DMARC or SPF failure, a Reply-To on a different domain than the From address, a display name that contains a different email address than the real one, and a DKIM signature from an unrelated domain. Several together are the pattern of a phishing message.
Headers can be forged too, but only the lines the sender controls. The lines added by your own mail server, at the top, are the ones you can trust, and that is why the checks above come from there.
Worked examples
A failed message
From bank.example, replies to bank-secure.example, DMARC failed.
DMARC failed (high) SPF softfail (medium) Replies go to a different domain (medium) The display name shows a different address (medium)
The sender domain's own policy says this message did not come from it, and the reply address is on a look-alike domain.
Reading the delay
Three servers handled it, at 07:02:00, 09:12:29 and 09:12:30.
out.shady-sender.example to mail-sor-f41.google.com first hop mail-sor-f41.google.com to mx.example.org +2.2 h mx.example.org +1 s
The long gap sits before the receiving provider, so the delay happened at the sender's side or in transit.
A normal newsletter
Sent through a mailing service, signed with the service's domain.
SPF passed DKIM passed DMARC passed The bounce address is on a different domain (low)
A different bounce domain is expected for bulk mail. With all three checks passed there is nothing to worry about.
Frequently asked questions
Where do I find the email headers?
What does SPF softfail mean?
What if there is no Authentication-Results header?
Can the headers be faked?
Why does a legitimate email show a different Return-Path?
Does this tool send my email anywhere?
What should I do with a phishing message?
Keep reading
See what attackers see, for free
Run the free passive check on your website. No login, no impact on your site, results in seconds.
Ready for the full manual audit? See pricing