Headers are parsed entirely in your browser — nothing is uploaded.
Trace email headers and read SPF/DKIM/DMARC, free. Every email carries a stack of headers (RFC 5322) that record how it was built and delivered — including a chain of Received lines added by each mail server it passed through and an Authentication-Results line summarizing SPF, DKIM and DMARC. This analyzer parses raw headers you paste, reconstructs the delivery hops with the delay at each one, and surfaces the authentication results — entirely in your browser.
It rebuilds the Received hop chain in delivery order with per-hop delays and extracts the SPF, DKIM and DMARC verdicts, so you can diagnose slow delivery and spot spoofing without sending the message to a third-party service. 100% free, no registration, and complete privacy — everything runs locally in your browser, so your data never touches a server.
Parses every Received header and shows the path in delivery order, from origin to your mailbox.
Computes the time between consecutive Received timestamps so you can see exactly where a message was held up.
Extracts the authentication verdicts from Authentication-Results (and Received-SPF) to help spot spoofing or misconfiguration.
Headers are parsed locally in your browser; nothing you paste is uploaded, logged or stored — safe for real messages.
Parse a User-Agent string
Break a URL into parts
Inspect a JSON Web Token
In most mail clients use 'Show original', 'View source' or 'Show raw message' (Gmail: ⋮ → Show original; Outlook: File → Properties → Internet headers). Copy the whole header block and paste it in.
Mail servers add each Received header to the top, so the raw order is newest-first. The tool reverses them to show the true delivery order — from the originating server down to your mailbox — and computes the delay between each pair of timestamps.
SPF checks the sending IP is authorized for the domain; DKIM verifies a cryptographic signature; DMARC ties them to the visible From domain and sets a policy. A 'pass' on all three is a strong authenticity signal; a 'fail' on SPF or DKIM, especially with DMARC, is a common sign of spoofing or misconfiguration.
A long gap between two Received timestamps usually means the message queued at that server — greylisting, rate-limiting, or an overloaded relay. The per-hop delay pinpoints which server held it.
No. All parsing happens in your browser; the header text never leaves your device, so it's safe to analyze real, sensitive messages.
We use cookies for analytics and personalized ads to help keep these tools free. Until you accept, ads stay non-personalized and analytics cookies are off. See our Privacy Policy.