Reveal the True Sender Behind Any Email

For security analysts, IT admins, and anyone who needs to verify email authenticity. Paste raw headers to extract sender IP, mail route, and SPF/DKIM/DMARC results — no signup, all in your browser.

Open the Tool

Why use Email Header Analyzer?

Extracts sender IP and full mail server route from Received headers

Parses SPF, DKIM, and DMARC authentication results

Highlights timestamps and Message-ID for forensic analysis

Works entirely in your browser — no data leaves your device

Clear verdict: authentic, suspicious, or spoofed

How it works

  1. Open the suspicious email in your mail client and view the raw headers (usually under 'Show original' or 'View headers').
  2. Copy the entire header block and paste it into the input field above.
  3. Click 'Analyze Headers' to run the parser.
  4. Review the structured output: sender IP, mail route, SPF/DKIM/DMARC status, and timestamps.

FAQ

What is an email header and why should I analyze it?

Email headers are hidden metadata that record the path an email took from sender to recipient. Analyzing them reveals the true sender IP, mail servers, and authentication results, helping you detect spoofing or phishing.

What do SPF, DKIM, and DMARC mean?

SPF verifies the sending server's IP is authorized for the domain. DKIM checks a cryptographic signature to ensure the message wasn't altered. DMARC ties SPF and DKIM to the From domain and tells you what to do if they fail.

Can this tool tell me if an email is definitely fake?

It provides strong indicators: failed authentication, mismatched sender IPs, or suspicious routes. However, always combine with other checks and never click links or attachments from untrusted sources.

Is my email header data stored or shared?

No. All parsing happens locally in your browser. Your data never leaves your device and is not sent to any server.