Email Header Analyzer Guide
Parse raw email headers, list the delivery hops and show where the time went.
A short companion for Email Header Analyzer: when it is useful, what it expects, and what to check before using the result.
What it does
Paste the raw headers of a message and the page lays out the delivery path: each Received hop in order, the hosts and IP addresses involved, the time between hops, and the SPF, DKIM and DMARC verdicts from the Authentication-Results header. Nothing leaves the browser.
Use the tool
Open Email Header Analyzer, add the input the tool asks for, run it, and check the output before using it elsewhere.
Input and output
- Input: text.
- Output: text.
- Category: Network.
Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.
Questions
Why do the hops appear in a different order from the paste?
Mail servers prepend a Received header, so the first one in the file is the most recent hop. The analyzer reverses them so hop 1 is where the message started and the last hop is where it arrived, which is the order the journey happened in.
How is the delay between hops worked out?
Each Received header ends with a timestamp after the semicolon. The page parses those timestamps and subtracts consecutive ones, so a large gap points at a server that queued the message. Clock skew between servers can make a delay look negative.
What do the SPF, DKIM and DMARC values mean?
They are the receiving server's verdicts. pass means the check succeeded, fail means it did not, and softfail, neutral, none or temperror are the softer outcomes. They come from Authentication-Results and are reported exactly as written.
Can I use this to trace spam?
It helps. The earliest hop and the sending IP are the most useful, and the authentication verdicts show whether the sender was allowed to use the domain. Treat the headers as evidence to check, not proof, since earlier hops can be forged.
Related guide
For broader background, see Email Debugging.