Reveal the True Sender Behind Any Email
For security analysts, IT admins, and anyone who needs to verify email authenticity. Paste raw headers to extract sender IP, mail route, and SPF/DKIM/DMARC results — no signup, all in your browser.
Results update live as you type — no button needed. The Example button fills a sample input.
🔒 You've used your 20 free runs for today
Every tool is free up to 20 conversions a day. Get Pro — $4.99 one-time to unlock every tool with no daily limit.
💳 Buy Pro — $4.99 🔓 I have a code
Free runs reset at midnight (UTC).
Why use Email Header Analyzer?
Extracts sender IP and full mail server route from Received headers
Parses SPF, DKIM, and DMARC authentication results
Highlights timestamps and Message-ID for forensic analysis
Works entirely in your browser — no data leaves your device
Clear verdict: authentic, suspicious, or spoofed
FAQ
What is an email header and why should I analyze it?
Email headers are hidden metadata that record the path an email took from sender to recipient. Analyzing them reveals the true sender IP, mail servers, and authentication results, helping you detect spoofing or phishing.
What do SPF, DKIM, and DMARC mean?
SPF verifies the sending server's IP is authorized for the domain. DKIM checks a cryptographic signature to ensure the message wasn't altered. DMARC ties SPF and DKIM to the From domain and tells you what to do if they fail.
Can this tool tell me if an email is definitely fake?
It provides strong indicators: failed authentication, mismatched sender IPs, or suspicious routes. However, always combine with other checks and never click links or attachments from untrusted sources.
Is my email header data stored or shared?
No. All parsing happens locally in your browser. Your data never leaves your device and is not sent to any server.
Example input
Try it with this sample — paste it into the box above:
Delivered-To: user@example.com
Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])
by mx.example.com with SMTPS id abc123
for <user@example.com>; Mon, 15 Jan 2024 10:23:45 -0800
Received: from unknown (HELO sender.example.org) (192.0.2.55)
by mail-sor-f41.google.com with SMTP; Mon, 15 Jan 2024 10:23:40 -0800
Authentication-Results: mx.example.com;
spf=pass smtp.mailfrom=sender.example.org;
dkim=pass header.d=example.org;
dmarc=pass header.from=example.org
From: "Sender" <sender@example.org>
To: user@example.com
Subject: Test message
Date: Mon, 15 Jan 2024 10:23:35 -0800
Message-ID: <abc123@example.org> How to use Email Header Analyzer
- Enter or paste your data into the Raw Email Headers box above.
- The result appears instantly in the Analysis Result box — everything runs in your browser, nothing is uploaded.
- Use Copy or Download to keep the result, or Example to load a sample first.
More Security & Forensics tools
Base64 Strings Extractor - Decode Every Blob in Forensic Text Dumps
Extract and decode every Base64 blob hidden in Cellebrite UFED exports, hex dumps or logs.
Code Deobfuscator - Decode Obfuscated Code Online
Free online code deobfuscator. Instantly decode URL-encoded obfuscation to reveal readable
Comcast Bill Analyzer - Compare Bills & Spot Hidden Changes
Compare two Comcast bills, terms, or emails side by side. Instantly highlight differences
Cron Time Analyzer - Cron Expression to Human Readable
Convert cron expressions to human-readable schedules and get warned about the risky 2-3 AM
Related tools
Cron Expression Validator - Check Cron Syntax Online
Validate cron expressions instantly. Paste a crontab schedule and get a valid/invalid verd
Regex Tester & Learning Tool - Test Patterns Online
Learn regex by doing. Test patterns, highlight matches, inspect capture groups, and read p
Regex Starter - Free Online Regex Tester & Learner
Test regular expressions instantly with live matching and plain-English explanations. Perf
Regex Tester - Test & Debug Regular Expressions Online
Quickly test and debug your regular expressions with our free online regex tester. See mat
Spring Boot Root Cause Extractor | Log Analyzer
Extract the root cause exception and key stack frames from verbose Spring Boot logs instan
Cron to Human: Understand Schedules Instantly
Convert cron expressions to plain English instantly. Vela Scheduling helps ops, PMs, and d
← All tools · Security & Forensics