Email diagnostics
Email Header Analyzer
Turn raw message headers into a readable evidence report: delivery hops, clock differences, recorded authentication claims, identity fields, MIME parameters, and privacy cautions.
Offline analysis. Pasted headers are parsed only in this browser tab. This tool makes no lookup or upload request, uses no persistent storage, and never opens URLs found in the header.
Where do I find full headers?
- Gmail: open the message, choose More, then Show original.
- Outlook on the web: choose More actions, View, then View message source.
- Outlook desktop: open the message, then File, Properties, and copy Internet headers.
- Apple Mail: choose View, Message, then All Headers. Thunderbird: View, Headers, All.
Paste headers to begin
The parser preserves the original evidence and treats every field as untrusted text.
Findings in plain language
Signals to investigate, not an automated legitimacy verdict.
Message and identity
Display identities are easy to forge; compare them with trusted receiving-system evidence.
Authentication evidence
Results are reproduced as claims, with the recording authserv-id or source field when available.
Recorded delivery route
Shown oldest to newest (origin-side record toward mailbox-side record). Header order and server clocks are not independently trusted.
| Hop | From | By | Protocol / TLS cue | Timestamp (UTC) | Gap | IP scope |
|---|
All parsed fields and raw evidence
Repeated fields keep their original order. Controls are visualized in the page; exports retain escaped evidence.
| # | Field | Decoded / unfolded value | Notes |
|---|
Show original header block
Copy, export, or print
CSV cells beginning with spreadsheet formula characters are prefixed with an apostrophe. JSON preserves the full structured report and raw header block; treat every export as sensitive.