Email Header Analyzer

The email you see in your inbox is a rendering of much more information than it shows: every server that touched the message on its way to you prepends a Received header, and the sender's mail server typically declares whether it passed SPF, DKIM, and DMARC checks in an Authentication-Results header. That raw header block is where the real evidence about an email's origin actually lives.

This tool parses that block properly, including RFC 5322's line-folding rules (long header values are often split across multiple indented lines, which have to be rejoined before parsing makes sense), then reconstructs the delivery chain. Because Received headers are prepended newest-first as a message travels, hop-by-hop delays are computed by comparing each hop's timestamp against the one after it — the same logic mail administrators use manually when tracing a delivery problem.

It also parses the Authentication-Results header for SPF, DKIM, DMARC, and ARC outcomes, and checks whether the visible From address lines up with the Reply-To and Return-Path addresses — a mismatch there is a common (though not definitive) phishing signal, since it means replies or bounces go somewhere other than where the message claims to be from.

Every finding is presented as a signal to review, not a verdict — this tool deliberately doesn't claim to definitively tell you an email is fake or safe, since that kind of false certainty is more dangerous than no answer at all. What it does is surface the same raw evidence a security analyst would look at, clearly labeled, so you can make an informed judgment.