Email Header Analyzer
Inspect delivery hops and reported email authentication results locally.
Paste headers only or a complete raw message. Content after the first blank line is ignored.
Local analysis
Inspect the delivery evidence
Headers are parsed in this tab. StackCache does not upload, retain, or independently authenticate the message.
Working notes
Use Email Header Analyzer with the boundary visible.
Email Header Analyzer locally unfolds and decodes raw message headers, extracts reported SPF, DKIM, DMARC, and ARC results, reconstructs Received hops, and highlights details worth reviewing.
What is Email Header Analyzer?
Every email message carries a set of headers that record its journey from sender to recipient. These headers include the sender and recipient addresses, subject line, timestamps, and — most importantly for troubleshooting — the Received headers that trace each mail server the message passed through, and the Authentication-Results headers that record whether SPF, DKIM, and DMARC checks passed or failed. Email headers are the primary diagnostic tool for investigating delivery problems, phishing attempts, spoofing, and authentication failures. However, raw headers are dense, multi-line, and encoded in formats like RFC 2047 that are not human-readable. This analyzer unfolds continuation lines, decodes encoded words, reconstructs the delivery path from Received headers (with timing between hops), and extracts authentication results into a clear summary. All parsing happens locally in your browser — your email headers (which may contain internal server names and IP addresses) are never uploaded.
When to use it
- Investigating phishing emails — inspect Authentication-Results to see if SPF, DKIM, and DMARC passed or failed, and check whether the Reply-To domain matches the From domain.
- Diagnosing delivery delays — reconstruct the delivery path from Received headers and calculate the time spent at each hop to identify where delays occurred.
- Verifying email authentication — confirm that your domain's outgoing emails pass SPF, DKIM, and DMARC checks at the receiving server.
- Tracing email routing — follow the Received headers to understand which servers handled the message, useful for debugging relay and forwarding configurations.
- Auditing ARC (Authenticated Received Chain) — inspect ARC headers that preserve authentication results across forwarding hops.
How to use it
- 01Copy the complete raw headers from your mail client and paste them into the analyzer.
- 02Review the reported authentication assertions, delivery hops, timing, and domain observations.
- 03Confirm suspicious findings with the receiving mail system or domain owner; header text alone is not proof of authenticity.
Synthetic example
Inspect a synthetic delivery
Input
From, Reply-To, Authentication-Results, and two Received fields using example.com domains
Result
SPF, DKIM, and DMARC reported pass · two delivery hops · Reply-To domain review
Limits and data boundary
- Header fields can be forged; StackCache parses reported evidence but does not independently verify signatures, DNS policy, or sender identity.
- RFC 2047 UTF-8, ASCII, Latin-1, and Windows-1252 display words are decoded; unsupported encodings remain unchanged.
- Input is limited to 256 KiB and content after the first blank line is ignored.
Frequently asked questions
- How do I get the raw email headers?
- In Gmail, open the message, click the three-dot menu, and choose "Show original." In Outlook, open the message properties. Other clients have similar options — search for "view source" or "show headers."
- What authentication results does the tool check?
- It extracts reported SPF, DKIM, DMARC, and ARC results from Authentication-Results headers. These are the assessments the receiving mail server recorded, not independent verification.
- Is my email content analyzed?
- No. Only headers are parsed. Anything after the first blank line (the message body) is ignored. All analysis runs locally in your browser.
Keep working