Paste an email header to trace where the email came from. See the delivery route, the sender IP, SPF, DKIM and DMARC results, and warning signs of fake or phishing emails.
| Hop | From | By | Protocol | Encrypted | Time | Delay |
|---|
Every email carries a header: a block of technical lines that most email apps hide. It records the sender, the recipient, every mail server the message passed through and the results of security checks. Raw headers are long and hard to read, so an email header analyzer turns them into a clear report that shows where an email came from and whether it can be trusted.
Open the email, click the three dots next to Reply and choose Show original. Click Copy to clipboard and paste it above.
On the web or in the new Outlook, open the message, click the three dots and choose View, then View message source. In classic Outlook, open the message and go to File, Properties, Internet headers.
Select the message and choose View, Message, All Headers or Raw Source.
Open the email, click the three dots and choose View raw message.
A raw header can run to 50 lines or more, but only a handful of them matter for most questions. These are the fields worth knowing:
| From | The sender name and address you see in your inbox. It is easy to fake, so never trust it on its own. |
|---|---|
| Reply-To | Where your reply goes. If it points to a different domain than From, be careful. |
| Return-Path | Where bounces go. Email services often use their own domain here, which is normal. |
| Received | One line added by every server that handled the email. Together they show the full delivery route. |
| Authentication-Results | The SPF, DKIM and DMARC results, written by your own mail provider when the email arrived. |
| DKIM-Signature | The digital signature, including the domain (d=) that signed the message. |
| Message-ID | A unique ID created by the sending system. Its domain often shows which service sent the email. |
| X-Mailer or User-Agent | The app or script that created the email, such as Outlook, Apple Mail or a PHP mailer. |
Every mail server that touches an email adds a new Received line to the top of the header. That means the bottom Received line is the first server, close to the sender, and the top one is your own mail provider. Read them upwards and you follow the email's journey from start to finish.
Each line says which server the email came from, which server received it, the protocol used and the exact time. Our analyzer puts them in the right order for you and works out the delay between each step, so you can see at a glance where an email got stuck.
One important detail: a sender can add fake Received lines at the bottom of a header, but they cannot change the lines added later by servers they do not control. The top lines, added by your own provider, are the ones you can trust most.
The sender IP is the first public IP address in the delivery route. For email sent through a business server, a web host or a marketing service, it usually belongs to that server. That is useful: you can see whether an email that claims to be from your bank really came from your bank's servers.
What it usually will not show is a person's home or location. Gmail, Outlook, Yahoo and most other large providers send email from their own servers and leave the user's own IP out of the header. So treat the sender IP as "which system sent this", not "where is this person".
Sender Policy Framework lists the servers allowed to send email for a domain. A fail means the email came from a server the domain did not approve.
DomainKeys Identified Mail adds a digital signature to the email. A pass shows the message was not changed after it was signed.
DMARC checks that the From domain matches SPF or DKIM. A DMARC fail is one of the clearest signs that the sender address was faked.
If you are unsure, do not click links or open attachments. Contact the company through its official website or app instead.
Email headers are not only for spotting scams. If your own emails arrive late or land in spam, the header of one of those emails usually shows why.
Anyone who has looked at a suspicious email and thought "is this real?" can use it. IT and help desk teams use header checks every day to investigate phishing reports and delivery complaints. Email marketers use them to confirm that SPF, DKIM and DMARC pass before a big campaign. And regular people use them to check a strange invoice or a "your account is locked" message before they click anything.
Sending your own emails? Check your content with the email spam checker and clean your list with the email checker.