Email header decoder
Paste the raw headers (in most clients: “Show original” or “View source”). Parsing happens in your browser — nothing is uploaded or stored.
How to read the results
SPF says whether the sending server was authorized by the domain. DKIM says whether the message signature is intact. DMARC says whether either of those aligns with the visible From domain — that alignment is what stops impersonation. A Reply-To or Return-Path on a different domain than From is one of the most reliable tells in business-email-compromise attempts.
Definitions live in the glossary; to score the message body itself, use the phishing checker.
When people use this
Confirming a spoofed sender
The display name says your CEO, but the headers show a failing SPF check and an origin server with no relationship to your domain.
Working out why legitimate mail got quarantined
Decoding your own outbound headers shows whether DKIM signing or an SPF include is misconfigured before you argue with a mail provider.
Tracing the real delivery path
Read the Received hops in order to see which relays handled the message and where it entered your environment.
Evidence for an incident write-up
Analysts paste headers to capture authentication results and timestamps in a form they can quote in a report.
Frequently asked
- How do I get the raw email headers?
- In Gmail open the message, click the three-dot menu and choose "Show original". In Outlook open the message, then File > Properties and copy the Internet headers box. Paste the whole block here.
- What do SPF, DKIM and DMARC failures mean?
- SPF checks whether the sending server was authorised for that domain, DKIM checks whether the message was signed and unaltered, and DMARC decides what to do when either fails. A DMARC fail on a domain that should be protected is a strong spoofing signal.
- Can I trust the From address?
- Not on its own — it is trivially forged. The Received hops and the authentication results in the headers are what show where the mail actually came from.
- Is anything uploaded when I paste headers?
- No. The decoding happens in your browser, so header contents never leave your device.
- Why are there so many Received lines?
- Each server that handled the message adds one, newest first. Reading them bottom-up shows the delivery path and often reveals an unexpected origin country or relay.
New to these terms? Start with the security glossary, or check the message body with the phishing checker.