All tools
[ tool · 01 ] Email forensics

Email Header
Analyzer

Paste a raw email header.
The parser walks the Received chain to show every relay hop, finds the first public IP, and reports SPF, DKIM, and DMARC results.
The header stays in your browser.

Runs in your browser Nothing uploaded
[ 01 ]

Paste Raw Header

raw-header.txt
How do I get a raw email header?

Most mail clients hide the routing information behind a menu. Open the message you want to analyze, then follow the steps for whichever client you use:

Gmail (web)

Click the three-dot menu next to the reply arrow, then choose Show original. A new tab opens with the full header text near the top. Copy from Delivered-To: downward.

Outlook (web)

Click the three-dot menu at the top of the message, then View → View message source. Copy everything in the dialog that appears.

Apple Mail (macOS)

With the message open, hit ⌘ ⇧ H (or use View → Message → All Headers). The header text appears above the message body.

Proton Mail

Open the message, click the three-dot menu, then View headers. Copy what appears in the dialog.

Other client? Look for "View source", "View original", "Show original", or "All headers" in the message menu. Once copied, paste it into the box above.

No header yet. Paste one above or click Try a sample.