Email Header Analyzer
Paste raw email headers to trace the delivery path, read the SPF / DKIM / DMARC results, and see the message's likely origin IP and reverse DNS.
- SPF, DKIM & DMARC results at a glance
- Routing hops, delays, and originating IP
- Spots spoofing signals a normal inbox hides
What email headers tell you
Every mail server that touches a message stamps a Received header, so the headers are a receipt of the message's journey — bottom to top, origin to inbox.
The receiving server also records the SPF, DKIM, and DMARC results it computed.
Reading them is how you tell a legitimate message from a spoofed one.
How to get the headers
In Gmail, open the message → ⋮ → Show original. In Outlook, open the message → File → Properties → Internet headers. Paste the whole block above. Nothing is stored — the parse and one reverse-DNS lookup happen per request.
A DMARC fail here is a spoofing
signal. Set up DMARC monitoring to catch it across every message, not just one.
More free checks
DMARC Checker
Analyze your DMARC record for policy, reporting, and alignment issues. Get a security grade and the fixes that move it.
SPF Checker
Validate your SPF record, count DNS lookups against the 10-lookup limit, and catch a permissive +all before spammers do.
DKIM Checker
Probe common selectors or check your own. Verify key strength, revocation, and test-mode flags across every signer.
Want this monitored automatically?
A one-time check is a snapshot. Email Watch ingests your DMARC reports daily, flags spoofing the day it appears, and tells you exactly what to fix — free for 7 days, no credit card needed.
Start free trial