What is an email header?
An email header is the structured routing and identity metadata attached to a message. The visible From line is only one field. Mail systems add Received lines as the message travels, and receiving providers can record SPF, DKIM, and DMARC evaluation in Authentication-Results. Return-Path identifies the envelope address used for delivery handling, while Reply-To can direct responses somewhere other than the visible sender.
Raw headers can contain your address, recipient addresses, internal hostnames, message identifiers, IP addresses, and routing details. Treat them as sensitive. This analyzer runs locally and does not upload the pasted text. It extracts a limited set of fields for explanation; it does not contact DNS, reputation services, the sender, or any mail provider.
How to read email headers
Read authentication results as evidence recorded by the system that inserted that header. SPF checks whether the sending IP was authorized for the envelope domain. DKIM verifies a cryptographic signature for a signing domain when the message body and signed headers still match. DMARC evaluates alignment between the visible From domain and an authenticated SPF or DKIM domain. A pass can support authenticity, but it does not prove the message is benign or that a compromised authorized account was used safely.
Compare From, Return-Path, and Reply-To. Different domains can be legitimate for newsletters, support platforms, and mailing lists, but an unexpected Reply-To is worth attention when the message requests money, credentials, or an urgent private conversation. Display names are easy to choose and can contain a trusted brand or colleague while the actual mailbox belongs elsewhere. Expand the complete address before acting.
Understanding the Received chain
Mail servers normally prepend Received lines, so the newest trusted hop appears near the top and the earliest claimed hop appears lower. Each line can describe the system that handed off the message, the receiving system, a protocol, an identifier, and a timestamp. The chain can help reveal an unexpected route or a large time gap, but parsing arbitrary mail syntax is imperfect and private infrastructure may be hidden.
Headers below the last system you trust can be forged. An attacker can write convincing Received or Authentication-Results text before delivering the message to the first real receiving server. This page cannot identify your organization’s trust boundary automatically. Give the greatest weight to headers added by the receiving provider you know, and ask its security team to interpret a serious incident.
How to find headers in Gmail, Outlook, and Apple Mail
In Gmail on the web, open the message, use the three-dot More menu beside Reply, and choose Show original. In Outlook on the web, open the message, choose More actions, then View and View message details; wording can differ between editions. In Apple Mail on macOS, open the message and choose View, Message, All Headers, or View, Message, Raw Source for the complete source.
Copy the raw header block rather than the rendered message body. A normal header contains repeated lines such as Received plus fields like From, To, Subject, Date, Message-ID, and Authentication-Results. Analyze a copy and preserve the original message if it may be evidence. Do not forward the suspicious message to colleagues merely to ask whether it looks real; use the organization’s established reporting route.
Practical sequence
How to use this tool safely
- 01
Open the message without following its links or replying to the sender.
- 02
Use the mail provider’s Show original, message details, all headers, or raw source command.
- 03
Copy the raw header block and paste it into the analyzer on this page.
- 04
Review authentication, address alignment, and Received hops together, then verify requests independently.
Common questions
Email header analyzer FAQ
Can email headers prove who sent a message?
They can provide useful authentication and routing evidence, especially in trusted provider-added fields, but they are not absolute proof. Headers below the last trusted receiving hop can be forged, and an authorized account can still be compromised.
What does DMARC pass mean?
It means the receiver recorded an aligned SPF or DKIM result for the visible From domain under that domain’s policy. It does not guarantee that the content, links, request, or sender account is safe.
Why are From and Return-Path different?
Legitimate senders often use a delivery platform or separate bounce-handling domain. The mismatch is context to review, especially when authentication fails or the message asks for a sensitive action; it is not automatically fraud.
Are pasted email headers private?
They remain in this browser page and are not uploaded by login.com. Headers can still contain personal addresses and infrastructure details, so avoid copying the analysis into an unprotected channel.
References