How to use the email header analyzer
- In your mail app, open the message and choose Show original, View source or View headers. Copy the header block at the top.
- Paste it into the box. You can paste the whole message, and everything after the first blank line is ignored.
- Read the path of the message, oldest hop first, with the time of each hop and the delay since the one before.
- Check the key headers and the results written in the authentication header, then copy or print the report.
Formula
Hop delay = time of this hop - time of the previous hop
Total transit = time of the last hop - time of the first hop
Each Received header is added on top by a mail server, so the list is reversed
The time for a hop is the date written at the end of its Received header, converted to one clock, so servers in different time zones compare correctly.
A message with three hops
The sample has three Received headers. Read from the bottom up, the message was accepted by app01.example.net at 14:03:19 -0500, passed to mail-out.example.net at 14:03:22 and delivered to mx.example.org at 14:03:27. The delays are 3 seconds and then 5 seconds, so the total transit is 8 seconds and the slowest hop is hop 3.
The authentication header says spf=pass, dkim=pass and dmarc=pass, and the page shows those words as written. The From domain and the Return-Path domain are both example.net, so no mismatch note appears.
Reading the path
Every server that handles an email adds a Received line to the top of the headers, noting where it came from, who received it and when. Reading from the bottom up gives the route. Large gaps between times show where the message waited, for example in a queue, in a spam check or while a receiving server asked the sender to try again later.
A delay that looks large can also come from a clock set wrong on a server, or from different time zones, which the tool handles by converting every time. The Unix Timestamp Converter helps if a header uses seconds since 1970, and the Extract Emails and URLs tool pulls addresses out of text.
What the page cannot prove
Headers can be forged. A sender can add fake Received lines at the bottom of a message, and only the lines added by servers you trust are reliable. The authentication results are shown exactly as written, and the page does not check signatures or look anything up, so it cannot confirm that a message passed SPF, DKIM or DMARC.
When the From domain and the Return-Path domain differ, the page notes it. That is normal for mailing lists and sending services and does not by itself mean a message is fake. Do not click links in a message you do not trust, and report suspicious mail to your provider. The Access Log Summarizer and the Mailto Link Generator are other tools for working with mail and servers.
Assumptions and limits
- Headers are plain text lines in the form Name: value, with continuation lines starting with a space or a tab.
- The first blank line ends the header block, and a hop without a readable date has no delay.
- Dates are read in the formats mail servers write. Unusual date text is shown but not compared.
- Everything is read in your browser, and the headers are not sent anywhere or stored.
Frequently asked questions
Where do I find the headers of an email?
In most mail apps, open the message and look for Show original, View source or View message headers in the menu. Copy the block of lines at the top, which begins with Received or Delivered-To.
Why is the oldest hop listed first?
Servers add each Received header at the top, so the newest is first in the file. Reversing the list gives the order the message traveled, which is easier to read.
Does a pass in the header mean the message is genuine?
Not necessarily. The page shows what the header says without checking it, and headers can be forged. Only results added by a server you trust mean anything.
Why is a delay missing for a hop?
Either it is the first hop, which has nothing before it, or one of the two Received lines has no readable date. Both are needed to compute the gap.