Extract & inspect
Paste raw headers or drop an .eml file to trace the delivery path hop by hop, read SPF, DKIM, and DMARC results, spot spoofed domains, and detect tracking pixels — a private alternative to online header tools, run in your browser.
There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to analyze email headers
- Add the headers. Paste the raw header block, or drop an .eml file to read them automatically.
- Trace the path. Follow each Received hop from origin to inbox, with time gaps highlighted.
- Check authentication. See SPF, DKIM, and DMARC pass/fail and the domains they cover.
- Spot problems. Flag spoofed senders, odd relays, and tracking pixels.
Email headers record the true story of a message: every server it passed through and whether it was authenticated along the way. Reading them by hand is tedious, and pasting them into a random online analyzer leaks internal hostnames and IP addresses. This tool does the parsing locally instead.
It reconstructs the Received chain into an ordered delivery path, highlights unusual time gaps between hops, and lays out SPF, DKIM, and DMARC results with the domains each one covers. That's usually enough to tell a legitimate message from a spoofed one and to explain why a mail landed in spam.
To work with the message itself, open it in the Email viewer, save its files with the Attachment extractor, or archive it with Email to PDF.
Frequently asked questions
How do I read email headers?
Paste the raw headers (or drop the .eml). The analyzer turns the Received chain into a readable, ordered delivery path and explains the authentication results.
What do SPF, DKIM, and DMARC results mean?
They show whether the sending server was authorized (SPF), whether the message was signed and unaltered (DKIM), and how the domain says to treat failures (DMARC). Fails can indicate spoofing.
Can this help me tell if an email is spoofed or phishing?
It surfaces the signals: authentication failures, a mismatch between the From domain and the signing domain, and suspicious relay hops all point toward a forged sender.
Are my headers uploaded to analyze them?
No. Parsing happens in your browser tab, so headers that may contain internal hostnames and IPs never leave your device.
Related tools
- Email ViewerOpen and read .eml, .emlx, Outlook .msg, and .mbox email files right in your browser. See the formatted message, headers, and attachments — with remote images and trackers blocked by default. Nothing is uploaded.
- Attachment ExtractorPull every attachment out of .eml, .msg, and .mbox emails, and decode stubborn winmail.dat (TNEF) files that other apps can't open. Preview, save individually, or download them all as a ZIP — all on your device.
- Email to PDFConvert .eml, .msg, and .mbox emails into clean, selectable-text PDFs — one at a time or in a batch to a ZIP. The header block and message body are laid out for you, entirely in your browser with no upload.
- JWT decoderDecode & verify tokens