How it works
Every server that touches an email adds a Received header above all the previous ones, with its name, the name of the server that handed it the message, the protocol and the time. Read from bottom to top, they tell the message's whole journey: from the application that created it to your mailbox. The analyser puts them in order, converts every time to the same time zone and works out how long each hop took, which is the most direct way to find out where an email was delayed.
It also reads the Authentication-Results header, where the server that received the message records what SPF, DKIM and DMARC returned, and it compares the domains of the visible sender, the Return-Path, the Reply-To and the DKIM signatures. A mismatch is not always bad, because sending platforms sign with their own domain, but a Reply-To from another domain is one of the most common signs of phishing.
Headers can include addresses, internal IPs and the names of your organisation's servers. That is why the analysis runs entirely in your browser and the pasted text is not stored in the share link.
Examples
=?UTF-8?B?Q29uZmlybWFjacOzbiBkZSBwZWRpZG8gIzEwMjQ=?=Confirmación de pedido #1024An RFC 2047 encoded word: headers only allow ASCII, so subjects with accents travel in Base64 (B) or quoted-printable (Q) and the mail client decodes them.with ESMTPSAESMTP + TLS + AUTHThe with clause states the hop's protocol (RFC 3848): a trailing S means the connection was encrypted with TLS and an A that the client authenticated. A plain SMTP between public servers means that leg travelled in plain text.13:21:12 +0000 → 10:22:39 -0300+87 sEach server records the time in its own time zone. Everything has to be converted to UTC before subtracting: 10:22:39 at UTC−3 is 13:22:39 UTC, 87 seconds after the previous hop.Use cases
- Find out which server delayed an email that arrived hours late.
- Check a suspicious message before clicking: who really sent it, whether it passed SPF, DKIM and DMARC and where replies would go.
- Confirm that email from your domain goes out signed with DKIM and aligned with DMARC after setting up a sending platform.
- Find the IP of the server that delivered an email to look it up on blacklists or report abuse.
- Check whether any leg of the route travelled unencrypted.
- Read encoded subjects and names that a system shows as =?UTF-8?B?…?=.
Frequently asked questions
How do I copy an email's full headers?
In Gmail, open the message, tap the three-dot menu and choose "Show original". In desktop Outlook, open the message and go to File → Properties → Internet headers; in Outlook on the web, look for "View message details" in the message menu. In Apple Mail, View → Message → All Headers. Copy the whole block above the body and paste it here.
Can Received headers be forged?
The ones added by your provider's servers, which are the topmost, are trustworthy. The lower ones were written by whoever sent the message or by servers outside your control, so an attacker can make them up to mislead. That is why the first trustworthy hop is the first one your provider received: the IP listed there is the one that really delivered the email.
What does it mean if SPF passes but DMARC fails?
SPF validates the Return-Path domain, which the user does not see, while DMARC requires that domain or the DKIM signature domain to match the visible sender. If a platform sends with its own Return-Path and does not sign with your domain, SPF passes for the platform but does not align with yours, and DMARC fails. The usual fix is to set up DKIM with your domain on that platform.
Why does a hop have an earlier time than the previous one?
Because each server uses its own clock, and if one is not synchronised with NTP the times do not add up. Differences of a few seconds are normal; if you see negative minutes or hours, that server's clock is wrong and the delays for that leg are not reliable.
Is it safe to paste the headers of a work email here?
The analysis runs in your browser and the text is neither sent to any server nor stored in the share link. Even so, headers can reveal internal IPs, server names and addresses from your organisation, so be careful when sharing them with other people.