Free Email Header Analyzer
An email header analyzer parses raw RFC 5322 message headers, extracts Authentication-Results for SPF, DKIM, and DMARC verdicts, traces Received hop chains to identify sending infrastructure and delays, evaluates From/Reply-To/Return-Path consistency for spoofing indicators, and calculates an aggregate security score flagging likely spam, phishing, or legitimate delivery.
Paste the full raw email headers from your mail client into ScanSuite's email header analyzer and click analyze. The tool parses Authentication-Results, Received chains, Message-ID, From, Reply-To, and Return-Path fields, highlights SPF/DKIM/DMARC pass or fail status, maps routing hops, and assigns a security score with phishing and spam risk indicators.
Introduction to Email Header Forensic Analysis
Email headers contain the metadata trail that mail servers append as messages traverse the internet—from originating MTA IP addresses and authentication verdicts to forwarding hops, spam filter scores, and mailing list modifications. Security analysts, IT helpdesk staff, and vigilant users rely on header analysis to determine whether a message is genuine, spoofed, or part of a phishing campaign.
ScanSuite's free email header analyzer parses pasted raw headers entirely in your browser, extracting structured data from Authentication-Results, Received, DKIM-Signature, ARC-Seal, and X-* vendor headers. Results show whether SPF, DKIM, and DMARC passed or failed, whether the visible From address aligns with Return-Path and DKIM d= domains, and whether routing hops reveal suspicious geographic paths or known-abuse IP ranges.
Combine header analysis with the SPF DKIM checker to validate published DNS policies, DNS lookup for sender domain investigation, and SSL checker when phishing pages link to HTTPS credential harvesting sites.
SPF, DKIM, and DMARC
An email header analyzer (also called an email header parser or forensics tool) takes the plaintext header block from an email message—everything above the blank line separating headers from body content—and structures it into human-readable fields. Unlike reading headers manually in Gmail or Outlook, dedicated analyzers correlate Authentication-Results across hops, compute hop timing deltas, and apply heuristics for spoofing detection.
ScanSuite evaluates From versus Return-Path domain alignment, Reply-To redirection to unrelated domains, display name impersonation where the friendly name mimics an executive but the address is external, missing or failed DKIM signatures, SPF softfail or fail on the connecting IP, and DMARC fail despite appearing From a protected domain.
The security score aggregates authentication pass rates, header consistency checks, and known phishing patterns into a single rating, helping tier-1 support staff triage suspicious messages before escalating to security operations centers. Check the sender domain's DNS policy with /tools/spf-dkim-checker/.
Why Analyze Email Headers?
Phishing attacks increasingly use display name spoofing, lookalike domains, and compromised legitimate accounts that bypass naive content filters. Header analysis reveals authentication failures invisible in the rendered message body—a From address displaying ceo@company.com may fail DMARC when Return-Path shows a free webmail provider.
Incident responders investigating business email compromise (BEC) trace Received chains to identify the first external hop IP, correlate with threat intelligence, and document authentication gaps for legal and insurance reporting. ScanSuite accelerates this triage by parsing headers in seconds rather than manual field-by-field inspection.
Header analysis complements proactive DNS validation with the SPF DKIM checker, port scanning of suspicious sending infrastructure, and security headers review on linked phishing URLs.
Who Uses Email Header Analyzers?
IT helpdesk and security operations center analysts triage user-reported phishing emails, determining whether to block senders, pull messages from mailboxes, or escalate to incident response.
Email administrators debug deliverability issues by comparing Authentication-Results on delivered versus bounced messages after SPF, DKIM, or DMARC configuration changes.
Journalists, researchers, and fraud investigators trace email origins for source verification, identifying forwarding chains and mailing list intermediaries in leaked correspondence.
Received hops
When you paste raw headers, ScanSuite tokenizes RFC 5322 header fields, unfolding continuation lines, and builds a structured map of standard and vendor-specific X-headers. Authentication-Results from each MTA are parsed for spf=, dkim=, and dmarc= verdicts with optional reason clauses.
Received headers are parsed in reverse chronological order, extracting from IP addresses, by hostnames, and timestamps to reconstruct the delivery path and compute inter-hop delays that may indicate botnet routing or intentional delay tactics.
Heuristic scoring weights failed DMARC on organizational domains as critical, DKIM fail as high severity, SPF fail as medium, Reply-To mismatches as high, and missing Message-ID as informational. The aggregate score maps to risk labels: likely legitimate, suspicious, likely phishing, or likely spam.
Sample header walkthrough
From: "CEO Name" <external@gmail.com> with Display Name mimicking an executive but address on free webmail.
Authentication-Results: dmarc=fail reason=SPF and DKIM both fail or misalign with the organizational From domain.
Reply-To: attacker@phishing-domain.com differs from From, redirecting victim replies to attacker-controlled mailboxes.
Email Authentication Verdict Interpretation
| Verdict | Meaning | Typical Action | |
|---|---|---|---|
| dmarc=pass | Aligned SPF or DKIM pass | Likely authentic if From domain is trusted | |
| dmarc=fail | No aligned authentication | Treat as potential spoofing; investigate further | |
| spf=softfail | IP not authorized but not hard rejected | Suspicious; check SPF record with SPF DKIM checker | |
| dkim=fail | Signature invalid or body modified | Message may be tampered or misconfigured sender |
Why Does My Header Analysis Show Incomplete Authentication?
Forwarded messages may strip original Authentication-Results. Check ARC-Authentication-Results and ARC-Seal headers for preserved authentication chains.
Some clients display simplified headers. Ensure you copy the full original message source, not the reply-quoted subset.
Related tools
- SPF/DKIM Checker — Email authentication DNS
- SPF DKIM Checker — Validate published DNS authentication records for sender domains.
- DNS Lookup — Investigate sender domain MX, TXT, and NS records.
- SSL Checker — Check TLS certificates on phishing link destination domains.
- Security Headers Checker — Audit HTTP security on credential harvesting pages linked in emails.
- Hash Generator — Compute file hashes of suspicious email attachments for IOC reporting.
- Port Scanner — Probe sending infrastructure IPs discovered in Received headers.
Frequently Asked Questions
How do I read email headers?
Read the Received lines from bottom to top to trace the path from sender to you. Then check Authentication-Results for the SPF, DKIM and DMARC outcomes. Paste the full raw header above and the tool lays this out for you.
What do SPF, DKIM and DMARC pass or fail mean?
SPF checks that the sending server is allowed to send for the domain. DKIM checks that the message was signed by the domain and was not altered. DMARC checks that these line up with the visible From address. A failure does not always mean the email is fake, but together they are strong signs of spoofing. See also the SPF/DKIM checker.
How do I find the full header in Gmail or Outlook?
In Gmail, open the message, click ⋮ and choose "Show original". In Outlook on the web, open the message, click ⋯ and choose View → "View message source". In the Outlook desktop app, use File → Properties → Internet headers.
What is the Received header?
Each mail server appends a Received header documenting when and from where it accepted the message, forming a reverse-chronological delivery trail.
How do I view raw email headers?
In Gmail: open message, three-dot menu, Show original. In Outlook: File, Properties, Internet headers. Apple Mail: View, Message, Raw Source.
What are Authentication-Results headers?
MTAs add Authentication-Results documenting SPF, DKIM, and DMARC evaluation outcomes for each received hop.
What is Return-Path?
Return-Path (envelope sender) specifies bounce delivery address and participates in SPF checks, which may differ from the visible From header.
Can attackers forge email headers?
Some headers like From are set by senders and easily forged. Authentication-Results added by receiving MTAs and DKIM signatures are tamper-evident.
What does dmarc=fail mean?
The message failed DMARC because neither SPF nor DKIM achieved alignment with the From header domain, a strong spoofing indicator.
Why do SPF and DKIM pass but DMARC fail?
Alignment failure: SPF passed for mail.example.com but From shows example.com without organizational domain match under strict alignment.
What is display name spoofing?
Attackers set friendly From names to impersonate executives while using unrelated email addresses hidden unless recipients inspect headers.
What is ARC?
Authenticated Received Chain preserves authentication results across forwarding hops, adding ARC-Seal signatures verifiable by downstream MTAs.
How does the security score work?
The score weights authentication verdicts, From/Return-Path/Reply-To consistency, and known phishing heuristics into an aggregate risk rating.
Can I analyze headers from forwarded emails?
Yes, but original authentication may appear in ARC headers rather than top-level Authentication-Results. Include the full forwarded header block.
What is DKIM-Signature?
The signing MTA adds DKIM-Signature with selector, domain d=, and body hash b= that receivers verify against DNS public keys.
How do I trace the sender IP?
Find the bottom-most Received header (first hop) which typically shows the connecting IP address of the originating or relay MTA.
Are headers analyzed on ScanSuite servers?
No. Parsing runs entirely in your browser. Pasted headers are not uploaded to ScanSuite infrastructure.
What Reply-To mismatches indicate phishing?
When Reply-To points to a different domain than From, replies go to attackers while the message appears from a trusted sender.
How does this relate to the SPF DKIM checker?
The checker validates published DNS policies proactively; header analysis confirms whether a received message actually passed those checks.
What X-headers should I inspect?
X-Microsoft-Antispam, X-Google-DKIM-Signature, and X-Spam-Status provide vendor-specific spam scores and filter verdicts supplementing authentication results.
Is this email header analyzer free?
Yes. ScanSuite provides unlimited free client-side email header analysis without registration or daily limits.
How do I analyze an email header?
Copy the full header block from your mail client, including Received lines, and paste it here. The analyzer reads the hop order, SPF, DKIM, and the addresses the message claims. It does not fetch the remote mailbox.
Summary
ScanSuite's free email header analyzer parses raw message headers for SPF, DKIM, and DMARC authentication results, routing hop traces, and spoofing indicators. Paste headers from suspicious emails to receive instant security scores and phishing risk assessments entirely in your browser.