Paste the full raw headers from any email — most clients let you view or download the 'original message' — and this tool breaks down the delivery path, authentication results and key metadata into a readable table.
Every email carries a stack of hidden metadata that email clients hide by default: the chain of mail servers it passed through (each one adding a Received line), authentication results from the receiving server (SPF, DKIM, DMARC), and routing fields like Message-ID and Return-Path. This tool parses that raw text — folding multi-line header values back into single entries per the email header-folding rules — and organizes it into a table.
The Received lines are listed in reverse order (earliest hop first) so you can trace the actual path a message took from the sending server through any relays to your inbox, which is often the fastest way to spot an unusual or spoofed delivery pattern.
SPF (Sender Policy Framework) checks whether the sending server is authorized to send mail for that domain. DKIM checks a cryptographic signature that verifies the message wasn't altered in transit. DMARC ties the two together and tells receiving servers what to do if they fail. A 'pass' on all three is a good sign the message is legitimate and unaltered; a 'fail' — especially combined with a From address that doesn't match the sending domain — is a common signature of spoofed or phishing mail.
Keep in mind that header formatting can vary slightly between email clients and forwarding services, so if a field you expect to see isn't appearing in the results, double-check that you copied the complete original header block rather than a partially reformatted version from a forward.
In Gmail, open the message, click the three-dot menu, and choose Show original. In Outlook desktop, go to File → Properties and look at the Internet headers box. Most other clients have a similar 'view source' or 'view original message' option.
Some received emails, or headers copied incompletely, won't include an Authentication-Results header at all — this is common with internal mail or when a client trims headers on forward. It doesn't necessarily mean authentication failed, just that the result wasn't present in what you pasted.
It surfaces the same authentication data a security analyst would start with, but it doesn't make a final verdict. Combine a DMARC/SPF/DKIM fail with a mismatched From domain and suspicious links as stronger signals, and when in doubt, don't click through — verify with the sender through another channel.
It varies widely depending on the sender's and recipient's infrastructure, but 2–6 Received lines is typical for most business email. A very long or unusual chain can be worth a closer look.
No. Parsing happens entirely in your browser using JavaScript string processing — the header text you paste is never transmitted.