# Email header analyzer — trace delivery, SPF, DKIM & DMARC

> Free email header analyzer: paste raw headers or drop an .eml to trace the delivery path and read SPF, DKIM and DMARC results in your browser, with no upload.

Paste raw email headers or drop an .eml file to trace the delivery path hop by hop and read SPF, DKIM, and DMARC results. It's a private alternative to online header tools — nothing is uploaded.

Email headers record the true story of a message: every server it passed through and whether it was authenticated along the way. Reading them by hand is tedious, and pasting them into a random online analyzer leaks internal hostnames and IP addresses. This tool does the parsing locally instead.

It reconstructs the Received chain into an ordered delivery path, highlights unusual time gaps between hops, and lays out SPF, DKIM, and DMARC results with the domains each one covers. That's usually enough to tell a legitimate message from a spoofed one and to explain why a mail landed in spam.

To work with the message itself, open it in the Email viewer, save its files with the Attachment extractor, or archive it with Email to PDF.

## How to

1. **Add the headers.** Paste the raw header block, or drop an .eml file to read them automatically.
2. **Trace the path.** Follow each Received hop from origin to inbox, with time gaps highlighted.
3. **Check authentication.** See SPF, DKIM, and DMARC pass/fail and the domains they cover.
4. **Spot problems.** Flag spoofed senders, odd relays, and tracking pixels.

## FAQ

### How do I read email headers?

Paste the raw headers (or drop the .eml). The analyzer turns the Received chain into a readable, ordered delivery path and explains the authentication results.

### What do SPF, DKIM, and DMARC results mean?

They show whether the sending server was authorized (SPF), whether the message was signed and unaltered (DKIM), and how the domain says to treat failures (DMARC). Fails can indicate spoofing.

### Can this help me tell if an email is spoofed or phishing?

It surfaces the signals: authentication failures, a mismatch between the From domain and the signing domain, and suspicious relay hops all point toward a forged sender.

### Are my headers uploaded to analyze them?

No. Parsing happens in your browser tab, so headers that may contain internal hostnames and IPs never leave your device.


## Related tools

- [Email Viewer](https://www.safepaper.app/email/email-viewer)
- [Attachment Extractor](https://www.safepaper.app/email/attachment-extractor)
- [Email to PDF](https://www.safepaper.app/email/email-to-pdf)
- [JWT decoder](https://www.safepaper.app/security/jwt-decoder)

---

Canonical HTML: https://www.safepaper.app/email/email-header-analyzer
Markdown: https://www.safepaper.app/email/email-header-analyzer.md

There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check.