dotvitals

Email Header Analyzer

Paste raw email headers to see the delivery path, hop delays, authentication results and phishing red flags.

Your headers are read in this browser and never sent anywhere. The analysis runs entirely on this page: nothing is uploaded, stored, logged or shared. If you tick a box below, only the IP addresses found in the headers — or the sender's domain — are sent for a DNS lookup, and those are not stored either.How we handle data

About the email header analyzer

Every email carries a stack of Received headers, added by each server that handled the message on its way to your inbox, with the newest at the top. Reading them in reverse order reconstructs the actual path the message took, including the timestamp at each hop, which lets you see exactly where delays happened and whether the path makes sense for the claimed sender.

This tool parses that chain along with the Authentication-Results header, which records what the receiving server concluded when it checked SPF, DKIM and DMARC. It also computes the alignment those results rarely explain: an SPF pass is about the envelope sender, a domain the recipient never sees, so a pass for a domain unrelated to the From address supports nothing about the visible sender. That gap is where most real forgeries sit. Everything is parsed in your browser - the headers are never uploaded, stored or logged.

It also does the part the free analyzers leave out: it works out where the evidence stops. Every server adds its Received line on top of what it was given, so everything below the first line your own mail system wrote arrived with the message and could have been written by whoever sent it - including an Authentication-Results header claiming a pass. The tool identifies that boundary, says how confident it is, and labels every hop below it as the sender's claim rather than as a record.

How to get the raw headers

Gmail
  1. Open the message.
  2. Choose the three-dot menu at the top right of the message.
  3. Choose Show original, then Copy to clipboard.
Outlook (desktop)
  1. Open the message in its own window.
  2. Choose File, then Properties.
  3. Copy everything in the Internet headers box.
Outlook on the web
  1. Open the message.
  2. Choose the three-dot menu, then View, then View message details.
  3. Copy the whole box.
Apple Mail
  1. Select the message.
  2. Choose View, then Message, then All Headers.
  3. Select the header block and copy it.
Yahoo Mail
  1. Open the message.
  2. Choose the three-dot menu, then View raw message.
  3. Copy everything above the first blank line.

Common questions

How do I get the raw headers?
In Gmail, open the message menu and choose Show original. In Outlook, use File, Properties, and look at Internet headers. Most other clients have a similarly named option.
Are my headers uploaded?
No. Parsing runs entirely in your browser, and nothing is uploaded, stored or logged. Two optional boxes send a little: one sends the IP addresses found in the headers so we can look up their reverse DNS, and one sends the sender's domain so we can read its DMARC policy. Both are off by default, both are DNS lookups, and neither is stored. The page tells you afterwards exactly what was sent.
Does it show where the sender was?
No, and deliberately. We do not geolocate IP addresses here. An address tells you which network operator holds it, not where a person was: relays, forwarders, VPNs and shared hosting all sit between a message and its author, and a country label over any of them would be a guess presented as a fact. What the tool does show is the operator's reverse-DNS name, and whether that name checks out.
What does an Authentication-Results mismatch mean?
If the domain that passed SPF or DKIM is different from the domain shown in the From address, DMARC alignment fails, which is one of the clearest technical signs of a spoofed message.