What a mail header analyzer does
A mail header analyzer takes the raw text of an email's headers (everything above the blank line that separates headers from the body) and shows you which servers handled the message, who signed it, and whether the authentication checks pass. Everything runs in your browser - no data leaves your device.
In one screen you get four things: the basic identity block (From, To, Subject, Message-ID, Date), the SPF / DKIM / DMARC verdicts from the Authentication-Results header, a chronological Received-hop timeline (oldest first, with the delay between hops), and a 0-10 heuristic spam score with concrete reasons.
For every IP that appears in the Received chain you get a clickable link to the whois-lookup tool - one click and you can see who owns the relay server.
How to use it
- Copy the raw headers from your mail client. Gmail: open the message → three-dot menu → "Show original" → copy the whole text. Outlook: open the message → File → Properties → "Internet headers" field. Apple Mail: open the message → View → Message → All Headers.
- Paste into the textarea above. You can paste just the headers or the entire message - the tool slices the body off at the first blank line.
- Check the spam score at the top. Green 0-2 = looks healthy, yellow 3-5 = warning signs, red 6-10 = very likely phishing or spam.
- In the Authentication-Results section verify that SPF / DKIM / DMARC all show pass. One red verdict often means the message did not really come from the claimed sender.
- Scroll to the Received chain. The top hop (#1) is the oldest server - the first one that accepted the message. The bottom hop is the server that handed it to your mailbox.
- Click any IP in the chain to open whois-lookup in a new tab and see who that address belongs to.
- If you see a weird first hop (a "bank notification" whose first hop is a hosting box in a random country), you have strong evidence of sender spoofing.
When this is useful
Five everyday situations where a header analysis settles the question:
- Is this email phishing?. You got a "bank" message with a link to "verify your account". Compare From vs Return-Path vs the first hop in the Received chain. If the first server has nothing to do with the bank, it is textbook phishing.
- My critical email never arrived, the recipient says they sent the reply. Ask them for the complete headers of the message they think they got. You can trace the exact path, see where it stalled, and how long each hop took.
- Customer complaint: "Your email landed in spam". Look at the headers of the copy they forwarded. Most of the time you will find SPF fail or DKIM fail in Authentication-Results - that is a concrete cause, not a guess.
- Post-incident audit. An attacker sent emails from your company domain. From the headers of the suspicious messages you can tell whether they went through your real mail server (compromised account) or through a foreign server with a forged From (spoofing, your domain has no DMARC).
- Strange email from a coworker. The CFO emails the finance team asking for an urgent wire transfer. Check Reply-To and Return-Path - in BEC (Business Email Compromise) attacks they differ from the From field, so your reply lands with the attacker.
Related tools: email DNS checker (audit your domain's SPF/DKIM/DMARC), whois-lookup (owner of an IP in the Received chain), DNS lookup.