Free tool

Email header parser

Paste the raw headers of an email to see the path it took, the delay at every server, and whether SPF, DKIM and DMARC passed. The headers are read on the spot and not stored.

How to read email headers

Headers are the envelope of an email. Each server that handles the message adds a Received line at the top, so the chain is read from the bottom up: the last line is where the message started, the first line is where it arrived. Comparing the timestamps shows where a message waited.

Authentication-Results is written by the receiving server and records whether SPF, DKIM and DMARC passed. A message that fails DMARC while claiming to come from a known brand is a classic phishing sign.

Headers tell you where an email came from. To turn what the email says into data, such as an order number or a total, use the email parser or the email parsing API. A longer walkthrough is in the email header parser guide.

Frequently asked questions

How do I find the headers of an email?

In Gmail open the message, then the three-dot menu, then Show original. In Outlook on the web use View, then View message source. In Apple Mail use View, Message, Raw Source. Copy everything above the body.

Which Received line is the first hop?

The bottom one. Every server adds its Received line on top, so you read the chain from the bottom up.

What do SPF, DKIM and DMARC pass mean?

SPF pass means the sending server is allowed to send for the envelope domain. DKIM pass means the message was signed by the domain in d= and was not changed. DMARC pass means one of them passed for a domain aligned with the visible From address.

Is the header text stored?

No. The headers are analysed for this page view and not saved.

See your own email as JSON

Paste one into the demo, describe the fields and look at the result. No account needed.

Parse an email Pricing